lkml.org 
[lkml]   [1998]   [Jan]   [3]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
DateThu, 1 Jan 1998 20:31:59 +0100
FromPavel Machek <>
SubjectRe: hardlinks.... sucks... ;-(
> No, you are not right ;-( There is old Unix hole and you know it. And it's
> a kernel vfs issue. In general, this is *huge* hole. Novice in
> sysadmin's world can done this "not kernel issue":
> 
> user$ ln /etc/passwd ~/.some
> root# chown newuser /home/user -R
> 
> This is only common example. And this is a *serious* security bug.

No. You just need other tool than chown, you need tool that changes
uid->uid. And you run it as chown -from olduser -to newuser -R /,
which looks for all files owned by olduser and makes newuser own
them. Just go ahead and write this tool. (And mail me a copy ;-). (I
would also appredicate option to delete such files).

								Pavel

-- 
I'm really pavel@atrey.karlin.mff.cuni.cz. 	   Pavel
Look at http://atrey.karlin.mff.cuni.cz/~pavel/ ;-).

\
 
 \ /
  Last update: 2005-03-22 12:41    [from the cache]
©2003-2008