diff mbox series

[19/20] Squid: cachemgr.cgi does not have to be owned (hence writeable) by nobody

Message ID 3368b7e2-c4e8-076f-1dbc-75945b1a037f@ipfire.org
State Accepted
Commit f2ccb35fa4b233da3e25b43c7464b2a202a9a1fc
Headers
Series Prevent "nobody" from escalating privileges by using writeable binaries as a vehicle |

Commit Message

Peter Müller May 17, 2021, 7:07 p.m. UTC 
  Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 lfs/squid | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/lfs/squid b/lfs/squid
index 18cb30ef7..38675f3f3 100644
--- a/lfs/squid
+++ b/lfs/squid
@@ -149,7 +149,7 @@  $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	chown -R squid:squid /var/log/squid /var/log/cache /var/log/updatexlrator
 
 	cp /usr/lib/squid/cachemgr.cgi /srv/web/ipfire/cgi-bin/cachemgr.cgi
-	chown nobody.nobody /srv/web/ipfire/cgi-bin/cachemgr.cgi
+	chown root:root /srv/web/ipfire/cgi-bin/cachemgr.cgi
 
 	cp -f $(DIR_SRC)/config/updxlrator/updxlrator /usr/sbin/updxlrator
 	cp -f $(DIR_SRC)/config/updxlrator/checkup /var/ipfire/updatexlrator/bin/checkup