lkml.org 
[lkml]   [1996]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Are setuid #!/foo/bar scripts secure in Linux ?
Date
Followup to:  <Pine.LNX.3.95.960813215022.7933C-100000@xarius.demon.co.uk>
By author: Darren J Moffat <darren@xarius.demon.co.uk>
In newsgroup: linux.dev.kernel
>
> Nice, Idea but the way Perl does it is _very_, _very_, bad I just spent 3
> days trying to get a script that works perfectly well non setuid running
> when it as setuid (this is what prompted the original message) I had to
> rewrite nice clean code into hacky regexps with selections from them on
> the next line because of the way perl taints untrusted data.
>
> eg.
> In the non setuid version
> $device = $ARGV[0];
> In the setuid version
>
> $ARGV[0] =~ /(\S+)/;
> $device = $1;
>
>
> I know the regexps aren't complex but the setuid version is a major hack.
>
> If fact this belongs in a perl-advocacy list so I won't bring it up again.
>

Well, you *should* check that noone trying to make you pass something
as a flag or the like; if you don't want to do it "manually", then
define a subroutine:

sub launder {
local($arg) = @_[0];
$arg =~ /^-P(\w+)$/;
return $1;
};

$device = &launder($ARGV[0]);

Then run taintperl directly if you want to debug nonsetuid.

-hpa


\
 
 \ /
  Last update: 2005-03-22 13:37    [W:0.024 / U:0.888 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site