Subject: [78] Directory creation ownership

From: Michael Reamy <[email-masked]>
Date: Fri, 01 Jul 1994 10:45:03 -0400 (EDT)

Hi,

I have wu-ftpd 2.4 loaded and recently had somebody load games into
a directory.  I have the upload directory for a class set so that files
are created by users in the class worf are owned by crftp.  I had assumed
that directories that were created would also be owned by crftp.  This is
not the case though.  Directories created by worf users in /comm_research 
are owned by ftp.  This creates a security hole since anonymous users can 
now put files into the created directory.  I looked at the code and it 
appears that a mkdir() is done but not a chown() for the directory.
I can modify the code to do a chown but wanted to make sure that I had
not done something incorrect in ftpaccess and that I wasn't going to
introduce other problems.  

**** ftpaccess configuration ****
class   writer  anonymous       elvis.concert.net
class   worf    anonymous       worf.ncsc.org manowar.ncren.net
class   chile   anonymous       chile.ncren.net
class   local   real,guest,anonymous *.mcnc.org *.ncsc.org *.ncren.net
class   remote  real,guest,anonymous *

autogroup fourteen writer
autogroup sixteen worf
autogroup sixteen chile

upload /usr2/ftp * no
upload /usr2/ftp /pub yes ftp ftp 0644 nodirs
upload /usr2/ftp /comm_research* yes crftp sixteen 0664 dirs
**** end ftpaccess configuration ****

-- 

Michael G. Reamy ([email-masked])

The light at the end of the tunnel may be an oncoming dragon.