[sane-devel] Security concern about API sane_control_option()
olaf.meeuwissen at avasys.jp
Tue Feb 13 00:51:12 CET 2007
"simon.zheng" <Simon.Zheng at Sun.COM> writes:
> Olaf Meeuwissen wrote:
>> "simon.zheng" <Simon.Zheng at Sun.COM> writes:
>>> I'm a new commer for SANE & XSane. Here are some
>>> security questions when studying API sane_control_option().
>>> I would appreciate if anyone can give help.
>>> Is there any possibility sane_control_option() allows
>>> you to get or set any control that would allow one
>>> user to affect another user. For example:
>> sane_control_option() is there so that frontends can tell the backends
>> what the user wants to do. It's a very abstract interface and exactly
>> what options are available is left to the discretion of each backend.
> I find a spec on SANE Standard 2 draft,
> http://www.sane-project.org/sane2/0.08/doc014.html, which documents
> well-known options.How about those backend-specific options? Where are
> they documented? Manpage?
A lot of backends have a 'sane-$backend' man page. I'd expect their
options to be documented there, if at all.
Please note that backends are not required to support even the well-
>> So any security implications are not a result of sane_control_option()
>> but of the set of options a particular backend chooses to provide.
Hope this helps,
Olaf Meeuwissen EPSON AVASYS Corporation, SE1
FSF Associate Member #1962 sign up at http://member.fsf.org/
GnuPG key: 6BE37D90/AB6B 0D1F 99E7 1BF5 EB97 976A 16C7 F27D 6BE3 7D90
Penguin's lib! -- I hack, therefore I am -- LPIC-2
More information about the sane-devel