lkml.org 
[lkml]   [1997]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: again security proposal
No... See my message. chown must be run from root. This is "standard"
operation (changing user uid, etc). Also, I think that my patch (or
analog because I don't check all user's groups) must be included to
further kernels as a configurable option.

On Mon, 29 Dec 1997, Alan Cox wrote:

> > user. Well known hardlink attack ($ ln /etc/passwd ~/.somestuff; # chown user
> > /home/user -R; $ vi ~/.somestuff) now maybe done by any user. Any sysadmin
>
> If it can be then its a bug in 2.1.x
>
> [alan@diamondage alan]$ ln /etc/passwd ~/foom
> [alan@diamondage alan]$ chmod 755 foom
> chmod: foom: Operation not permitted
> [alan@diamondage alan]$ chown alan foom
> chown: foom: Operation not permitted
>
> 2.1
>
> [alan@roadrunner anarchy]$ ln /etc/passwd /tmp/foom
> [alan@roadrunner anarchy]$ chown alan /tmp/foom
> chown: /tmp/foom: Operation not permitted
>
> So I think you are seeing things
>


\
 
 \ /
  Last update: 2005-03-22 13:40    [W:0.062 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site