Messages in this thread |  | | From | Matthias Urlichs <> | Subject | Re: setuid scripts (was Re: proc fs and shared pids) | Date | Tue, 17 Sep 1996 06:14:59 +0100 |
| |
In linux.dev.kernel, article <Pine.LNX.3.95.960906174146.31788A-100000@xarius.demon.co.uk>, Darren J Moffat <darren@xarius.demon.co.uk> writes: > > $ setuidexec /bin/sh > Syntax error while executing setuidexec > Usage: #! setuidexec <shell> > > The reason for this is the setuidexec program (as posted in this list) > does the /dev/fd hack that Solaris 2.x does exactly _and_ checks the > permisons of the script _and_ creates a minimal standard environment _and_ > can't be run unless it is called via a #! mechanism.
But the only way to check the latter is via looking at argv[]. Thus, this check can be defeated by calling suidexec with a trivial C wrapper.
Nonono... setuidexec _must_ check whether the file system the script is on is mounted with nosuid/nosgid.
-- DIDI ... is that a MARTIAN name, or, are we in ISRAEL? -- Zippy the Pinhead -- Matthias Urlichs \ noris network GmbH / Xlink-POP Nürnberg Schleiermacherstraße 12 \ Linux+Internet / EMail: urlichs@noris.de 90491 Nürnberg (Germany) \ Consulting+Programming+Networking+etc'ing PGP: 1024/4F578875 1B 89 E2 1C 43 EA 80 44 15 D2 29 CF C6 C7 E0 DE Click <A HREF="http://info.noris.de/~smurf/finger">here</A>. 42
|  |