Bug#306877: mysql-server: debian-sys-maint shouldn't have ALL PRIVILEGES

2005-04-29 Thread sean finney
On Fri, Apr 29, 2005 at 02:19:34PM +0200, Christian Hammers wrote: > Using an abstraction layer instead of directly communicating with the > mysql admin tools might be a good idea - but, uhm, how does your > dbconfig-common package access mysql if not via something like the full > privileged debian

Bug#306877: mysql-server: debian-sys-maint shouldn't have ALL PRIVILEGES

2005-04-29 Thread Christian Hammers
Hello On 2005-04-29 sean finney wrote: > On Fri, Apr 29, 2005 at 09:36:00AM +0200, Christian Hammers wrote: > > That was correct in the past where this user really only had the RELOAD > > and SHUTDOWN privileges but nowadays it also serves as a more general user > > for e.g. packages that ask the

Bug#306877: mysql-server: debian-sys-maint shouldn't have ALL PRIVILEGES

2005-04-29 Thread sean finney
hey christian, On Fri, Apr 29, 2005 at 09:36:00AM +0200, Christian Hammers wrote: > That was correct in the past where this user really only had the RELOAD > and SHUTDOWN privileges but nowadays it also serves as a more general user > for e.g. packages that ask the user if they may create a databa

Bug#306877: mysql-server: debian-sys-maint shouldn't have ALL PRIVILEGES

2005-04-29 Thread Christian Hammers
severity 306877 wishlist retitle 306877 README.Debian: clarify use of debian-sys-maint thanks Hello On 2005-04-28 The Anarcat wrote: > The debian-sys-maint user is setup in the postinst to have mostly ALL > PRIVILEGES, WITH GRANT, even. As I understand it (and as the > README.Debian documents), t

Bug#306877: mysql-server: debian-sys-maint shouldn't have ALL PRIVILEGES

2005-04-28 Thread The Anarcat
Package: mysql-server Version: 4.0.24-5 Severity: grave Tags: security Justification: user security hole The debian-sys-maint user is setup in the postinst to have mostly ALL PRIVILEGES, WITH GRANT, even. As I understand it (and as the README.Debian documents), the debian-sys-maint user is mainly