On 19 April 2013 16:28, Gregory Matthews <greg.matth...@diamond.ac.uk>wrote:

> On 18/04/13 18:07, Hearns, John wrote:
> > As an aside, a normal user can trigger a drop of the caches before the
> start of a job.
> > If you have looked into it,  sudo echo 3 > /proc/sys/vm/drop_caches is
> well nigh impossible.
>
> eh?
> echo 3 | sudo tee /proc/sys/vm....
>

As a warning to anyone who doesn't know, if you don't configure sudo to
restrict the allowable command line arguments to tee, then the following
will work just as well:
cat /dev/zero | sudo tee /dev/sda

Also, be careful about allowing users to sudo programs such as "vi", "less"
and even "more" - because they all have the ability to create new shell
from within them (via the '!' command) - allowing people to
escalate privileges.

Cheers
-- 
Jonathan Barber <jonathan.bar...@gmail.com>
_______________________________________________
Beowulf mailing list, Beowulf@beowulf.org sponsored by Penguin Computing
To change your subscription (digest mode or unsubscribe) visit 
http://www.beowulf.org/mailman/listinfo/beowulf

Reply via email to