lkml.org 
[lkml]   [1996]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Proposal: restrict link(2)

Date: Mon, 16 Dec 1996 15:37:21 -0500 (EST)
From: "Richard B. Johnson" <root@analogic.com>

I think that a program that is set 4755 (priv bits)...
a user with a UID of 100 and a GID of 100, I can set my executable file :
chmod 4755 foo
with foo.c containing setuid(0) ; setgid(0); system("bash");.....
and It does NOT spawn a root shell.

Of course not. SUID and SGID stand for "set user id" and "set group
id", not "set root id" and "set root group;" they are not "privilege
bits" per se. So your foo program, when invoked (4755), will set have
its userid set to be you, and the group id unaffected. Since you, as
a user, are not permitted to setuid(0), neither is your program. :-)

-- Kris


\
 
 \ /
  Last update: 2005-03-22 13:38    [W:0.033 / U:2.792 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site