Messages in this thread | | | Date | Tue, 12 Jan 1999 15:13:55 -0500 (EST) | From | David C Niemi <> | Subject | Re: odd chown difference between 2.0 and 2.1pre kernels |
| |
On Tue, 12 Jan 1999, Raul Miller wrote: > > > Race condition if you can figure out what root is doing -- just setuid > > > between time root examines files and chown.
That race condition still exists in Linux 2.0.x. So if you are vulnerable to this attack in 2.2 you are also vulnerable in 2.0.x, it just may be a little harder to exploit.
> Alan Cox <alan@lxorguk.ukuu.org.uk> wrote: > > If you can edit a file root is planning to setuid root then there are > > bigger problems anyway > > Since when should chown root mean setuid root?
Since always in standard UNIX practice, if the file is already setuid.
> > > Alternatively, security bug if chown is used in a script written under > > > 2.0 (which relies on the current behavior). > > > > Name one. > > Hmm... I was envisioning making root owner on files when a user > is being removed from system.
A very bad practice -- if you are running around chowning things to root without looking at what you're chowning, either directly or though a script, you are in for a lot of trouble anyway the moment you venture outside a pure-Linux environment. Remedies include using an unprivileged ID to chown to; mounting your user-writable partitions nosuid (or even noexec); and regularly looking for suid files, e.g. AFTER you do your big chowns.
Please look at other major versions of UNIX, and write back if you can find at least one major flavor which has the behavior you want. I have checked IRIX, AIX, Solaris 2.x, and SunOS 4.x -- they are consistent with the new Linux behavior when chowning setuid files as root. I don't have any Digital UNIX, BSD, SCO, UnixWare, or HP/UX systems handy right now, but if you can find different behavior in ANY of them I'd like to hear about it.
--- David C Niemi ---niemi at tux.org--- Reston, Virginia, USA --- But only the man who cares about something in itself, who loves it and does it *con amore*, will do it in all seriousness. The highest achievement has always been that of such men, and not of the hacks who serve for pay. -- Arthur Schopenhauer
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |