Changeset 2904 in project for wiki/chicken-setup

Timestamp:

01/23/07 08:53:48 (14 years ago)

Author:

felix winkelmann

Message:

bugfix in tinyclos

File:

• wiki/chicken-setup (modified) (1 diff)

wiki/chicken-setup

@@ -546 +546 @@
 
 
+=== Security
+
+When extensions are downloaded and installed one is executing code
+from potentially compromised systems. This applies also when {{chicken-setup}}
+executes system tests for required extensions. As the code has been 
+retrieved over the network effectively untrusted code is going to be
+evaluated. When {{chicken-setup}} is run as ''root'' the whole system
+is at the mercy of the build instructions (note that this is also
+the case every time you install software via {{sudo make install}}, so this
+is not specific to the CHICKEN extension mechanism).
+
+Security-conscious users should never run {{chicken-setup}} as root.
+A simple remedy is to set the environment variable {{CHICKEN_REPOSITORY}},
+which will transparently place the repository at an arbitrary user-selected
+location. Alternatively obtain write/execute access to the default location
+of the repository (usually {{/usr/local/lib/chicken}}) to avoid running
+as root.
+
+
 === Other modes if installation