[lkml]   [2003]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: hard links create local DoS vulnerability and security problems wrote:

    > In any case, if a user is *MAKING* a program set-UID, it's probably because
    > he *wants* it to run as himself even if others invoke it (otherwise, he
    > could just leave it in ~/bin and be happy). So this is really a red herring,
    > as it's only a problem if (a) he decides to get rid of the binary, and fails
    > to do so because of hard links he doesn't know about, or (b) he's an idiot
    > programmer and it malfunctions if invoked with an odd argv[0]....

    Right... but non-privileged users _can't_ delete these extra links, even
    if they notice them from the link count. And non-idiots do make
    security errors -- they just fix them. But in this case, fixing the
    error after the fact may be impossible without root's help.

    And how many package managers / install scripts check for hard links of
    files they're about to overwrite?


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:58    [W:0.019 / U:23.632 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site