Re: [Bug-wget] [PATCH] Allow to redefine ciphers list for OpenSSL

[Petr Pisar]

On Tue, Jul 08, 2014 at 10:00:24AM -0400, Tomas Hozza wrote:
> I'm afraid this is not suitable for us. We need to be able to define the
> policy somewhere in /etc, where the user is not able to change it (only
> the system administrator).
>
I hope can also prevent the user from running his own wget executable, or
ld-preloading modified OpenSSL library, or intercepting open(2) calls to
provide fake /etc file.

> Also the main intention to have a single place to set the policy for all
> system components, therefore wgetrc is not the right place for us.
> 
What about to change wget to call OPENSSL_config(NULL) instead of setting some
hard-coded preference string. Then you can teach OpenSSL to load your /etc
configuration instead of patching each application.

-- Petr

pgpsQW6Ta47VE.pgp
Description: PGP signature