Subj : Re: Nightmares / Dreams
To   : Gamgee
From : 2twisty
Date : Sat Apr 02 2022 11:06:59

 Ga> user/group that the BBS runs as.  This allows the BBS to open the ports 
 Ga> (because of the 'sudo'), but then immediately fall back to running as a 
 Ga> normal user.  Synchronet can also be compiled with the 'setcap' command 

If you launch anything with SUDO as root, you have to TRUST that the software drops back.  

Has that code been audited?  

I wouls still worry that since the binary is started as root, there is a path (albeit maybe VERY difficult) to crash the app, corrupt RAM and execute arbitrary code.  

I prefer to launch all externally excessible stuff as unpriv users if at all possible.

So I'd go for the recompile or just run with port >1024.

--- Mystic BBS v1.12 A47 2021/12/24 (Linux/64)
 * Origin: The Ratrace Losers (21:3/166)

.