🚀 go-pugleaf

In article <14htt0INNiep@hilbert.math.ksu.edu> tar@math.ksu.edu (Tim Ramsey) writes:
>How do you get a complete list of files that are trusted by root, or by
>programs that root trusts (that is, are setuid root)?

To find out if a file is trusted, go to the man directories and grep the
filename on everything, then read the associated man pages where the filename
turned up (important files usually have their own man pages as well).

To find setuid root files, use the "find" command.

>Much easier to simply not have world-writable files owned by root.

Agreed.  Much easier to simply not have world-writable files at all, unless
you can come up with a real reason for needing them.  With UNIX supporting
setuid and setgid programs, it's fairly easy to work around these days.

But I still contend that there's nothing "special" about root owning a
world-writable file that would allow a user to exploit it over anyone else
owning the same file, other than getting around quotas.

-- 
John C. Fowler, jfowler@lanl.gov