lkml.org 
[lkml]   [1996]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: setuid scripts (was Re: proc fs and shared pids)
    Date
    In linux.dev.kernel, article <Pine.LNX.3.95.960906174146.31788A-100000@xarius.demon.co.uk>,
    Darren J Moffat <darren@xarius.demon.co.uk> writes:
    >
    > $ setuidexec /bin/sh
    > Syntax error while executing setuidexec
    > Usage: #! setuidexec <shell>
    >
    > The reason for this is the setuidexec program (as posted in this list)
    > does the /dev/fd hack that Solaris 2.x does exactly _and_ checks the
    > permisons of the script _and_ creates a minimal standard environment _and_
    > can't be run unless it is called via a #! mechanism.

    But the only way to check the latter is via looking at argv[]. Thus, this
    check can be defeated by calling suidexec with a trivial C wrapper.

    Nonono... setuidexec _must_ check whether the file system the script is on
    is mounted with nosuid/nosgid.

    --
    DIDI ... is that a MARTIAN name, or, are we in ISRAEL?
    -- Zippy the Pinhead
    --
    Matthias Urlichs \ noris network GmbH / Xlink-POP Nürnberg
    Schleiermacherstraße 12 \ Linux+Internet / EMail: urlichs@noris.de
    90491 Nürnberg (Germany) \ Consulting+Programming+Networking+etc'ing
    PGP: 1024/4F578875 1B 89 E2 1C 43 EA 80 44 15 D2 29 CF C6 C7 E0 DE
    Click <A HREF="http://info.noris.de/~smurf/finger">here</A>. 42

    \
     
     \ /
      Last update: 2005-03-22 13:37    [W:7.023 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site