lkml.org 
[lkml]   [1999]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: odd chown difference between 2.0 and 2.1pre kernels
On Tue, 12 Jan 1999, Raul Miller wrote:
> > > Race condition if you can figure out what root is doing -- just setuid
> > > between time root examines files and chown.

That race condition still exists in Linux 2.0.x. So if you are vulnerable
to this attack in 2.2 you are also vulnerable in 2.0.x, it just may be a
little harder to exploit.


> Alan Cox <alan@lxorguk.ukuu.org.uk> wrote:
> > If you can edit a file root is planning to setuid root then there are
> > bigger problems anyway
>
> Since when should chown root mean setuid root?

Since always in standard UNIX practice, if the file is already setuid.


> > > Alternatively, security bug if chown is used in a script written under
> > > 2.0 (which relies on the current behavior).
> >
> > Name one.
>
> Hmm... I was envisioning making root owner on files when a user
> is being removed from system.

A very bad practice -- if you are running around chowning things to root
without looking at what you're chowning, either directly or though a
script, you are in for a lot of trouble anyway the moment you venture
outside a pure-Linux environment. Remedies include using an unprivileged
ID to chown to; mounting your user-writable partitions nosuid (or even
noexec); and regularly looking for suid files, e.g. AFTER you do your big
chowns.

Please look at other major versions of UNIX, and write back if you can find
at least one major flavor which has the behavior you want. I have checked
IRIX, AIX, Solaris 2.x, and SunOS 4.x -- they are consistent with the new
Linux behavior when chowning setuid files as root. I don't have any
Digital UNIX, BSD, SCO, UnixWare, or HP/UX systems handy right now, but if
you can find different behavior in ANY of them I'd like to hear about it.

--- David C Niemi ---niemi at tux.org--- Reston, Virginia, USA ---
But only the man who cares about something in itself, who loves
it and does it *con amore*, will do it in all seriousness. The
highest achievement has always been that of such men, and not of
the hacks who serve for pay. -- Arthur Schopenhauer


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.061 / U:0.236 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site