lkml.org 
[lkml]   [1999]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: odd chown difference between 2.0 and 2.1pre kernels


> > % I consulted POSIX and UNIX98 as well, but they did not have anything to say
> > % about root doing chown and chgrp, so I went for "standard UNIX practice".
> >
> > The problem with this "standard UNIX practice" (for chown on set-id files)
> > is that set-id is used to mean "set the euid (egid) to *this* user (group)".
> > That is, it is used when someone wants a program to run with a specific set
> > of privileges, not the just the privileges of whatever the owner/group of
> > the file happen to be. Thus when chowned, the file has effectively suddenly
> > *become* a set-id file from the point-of-view of the new privileges---a
> > change which is likely to be undesirable (and exploitable). Clearing the
> > set-id status during a chmod seems to be the best way to avoid this
> > difficulty within the limitations of UNIX's security model.
>
> There is also the principle of "least surprise", which argues against
> making implicit and nonstandard actions that the user did not ask for. If
> we clear that bit we are going against standard UNIX practice, so far
> verified on SunOS 4, Solaris 2, AIX, IRIX, and even SCO. That's not to say
> we shouldn't do it, but we had better have a very compelling reason to be
> that nonstandard.

> And for the security implications, experienced system administrators expect
> that chowning files to root could be dangerous, and shouldn't be done
> without the same caution required when adding setuid bits.


Or there's the possibility that clearing the setUID bits will break
some scripts. Even if the scripts themselves aren't setUID, the
programs they exec might very well be. If adduser or something
changes owner of a setUID program when it's installed, then the script
has to be rewritten. Unlikely, but possible, and experienced admins
expect standard utilities to operate in a certain manner.




--

Robert Kiesling
kiesling@ix.netcom.com



--

Robert Kiesling
kiesling@ix.netcom.com


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.086 / U:0.868 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site