Subject: Re: solving various bug reports...
To: None <codewarrior@daemon.org>
From: Darren Reed <darrenr@cyber.com.au>
List: tech-security
Date: 06/27/1997 02:56:22
In some mail I received from Andrew Brown, sie wrote
> 
> >> 6. inetd runs before securelevel is raised
> >> ------------------------------------------
> >> 
> >> PR 1323 highlights that inetd(8) and other programs are run from
> >> /etc/rc before securelevel is raised. Therefore, it is possible for
> >> users to get into a system before securelevel is raised.
> >> 
> >> This is a complicated issue, and probably deserves its own thread.
> >> No idea on how to solve it.
> >
> >How about adding a loop to inetd that checks if the securelevel is 0
> >and if so, waits until it becomes > 0 ?  This is based on the theory
> >that securelevel is only 0 during booting and the eventual multiuser
> >value for securelevel > 0 whilst allowing it to start if secureleve is -1.
> 
> let's not reinvent the wheel here...after al, what's wrong with just
> moving inetd to the very end of rc, right before it prints the date?
> does anything started (currently) between it and the end of rc
> actually need to talk to it?  i didn't see anything...and i can't
> think of anything that might need that...

you still have a race condition.

securelevel doesn't change until after init is done with rc.