V1.59 (setuid/setgid shell scripts are a security risk)

Thread View: comp.bugs.4bsd.ucb-fixes

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by Keith Bostic Tue, 24 May 1988 03:01

#68

Author: Keith Bostic
Date: Tue, 24 May 1988 03:01

25 lines
1199 bytes

Subject: setuid/setgid shell scripts are a security risk
Index: sys/kern_exec.c 4.3BSD

Description:
	Setuid/setgid shell scripts have inherent problems that
	may be used to violate security.  These problems cannot
	be fixed without completely revising the semantics of
	executable shell scripts.
Fix:
	Panel your office in asbestos, and apply the following patch
	to sys/kern_exec.c.

*** kern_exec.c.orig	Sun May 22 14:07:19 1988
--- kern_exec.c.new	Sun May 22 14:07:55 1988
***************
*** 180,185 ****
--- 180,187 ----
  		bcopy((caddr_t)ndp->ni_dent.d_name, (caddr_t)cfname,
  		    MAXCOMLEN);
  		cfname[MAXCOMLEN] = '\0';
+ 		uid = u.u_uid;
+ 		gid = u.u_gid;
  		goto again;
  	}

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads