[lkml]   [2004]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Program-invoking Symbolic Links?
Date writes:

> On Thu, Aug 05, 2004 at 07:34:42PM +0200, Måns Rullgård wrote:
>> > ~luser/foo => "cp /bin/sh /tmp/...; chmod 4777 /tmp/...; cat ~luser/foo.real"
>> >
>> > Any questions?
>> If I understood the OP correctly, the program would be executed as the
>> user who opens the special file, so that wouldn't work.
> Yes, it would. Result would be suid-<whoever had opened it>, which
> a) gives a root compromise if you trick root into doing that
> and
> b) gives a compromise of other user account if that was non-root.

Of course you're right.

> Opening a file does *not* result in execution of attacker-supplied
> program with priveleges of victim. Breaking that warranty opens a
> fsck-knows-how-many holes.

Just look at msoutlook.

Måns Rullgård
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:04    [W:0.041 / U:4.672 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site