Messages in this thread | | | Date | Mon, 29 Dec 1997 18:45:31 +0200 (GMT-2) | From | Yuri Kuzmenko <> | Subject | Re: again security proposal |
| |
No... See my message. chown must be run from root. This is "standard" operation (changing user uid, etc). Also, I think that my patch (or analog because I don't check all user's groups) must be included to further kernels as a configurable option.
On Mon, 29 Dec 1997, Alan Cox wrote:
> > user. Well known hardlink attack ($ ln /etc/passwd ~/.somestuff; # chown user > > /home/user -R; $ vi ~/.somestuff) now maybe done by any user. Any sysadmin > > If it can be then its a bug in 2.1.x > > [alan@diamondage alan]$ ln /etc/passwd ~/foom > [alan@diamondage alan]$ chmod 755 foom > chmod: foom: Operation not permitted > [alan@diamondage alan]$ chown alan foom > chown: foom: Operation not permitted > > 2.1 > > [alan@roadrunner anarchy]$ ln /etc/passwd /tmp/foom > [alan@roadrunner anarchy]$ chown alan /tmp/foom > chown: /tmp/foom: Operation not permitted > > So I think you are seeing things >
| |