🚀 go-pugleaf

The following were derived from Matt Bishop's "How to Write a Setuid
Program" paper:

Isolate code which needs to be run setuid or setgid in a separate 
executable or function when possible.

Reset userid and groupid to that of the person running the program as soon 
as possible.

Be as restrictive as possible in selecting the UID and GID.

Reset effective UID and GID and close all unnecessary file
descriptors before calling exec, popen, system and any other command
that invokes another process.

Carefully validate any user supplied arguments to exec, system or popen.

Make no assumptions about environment variables. At a minimum, verify or
override PATH, IFS and SHELL. In some versions of UNIX,
overriding environment variables for shared libraries such as
LD_LIBRARY_PATH and LD_PRELOAD on SUN is also necessary.

It is not safe to use creat or functions that use creat for locking.

Catch ALL signals except SIGKILL and SIGCLD.

Check all function returns for errors and abort if anything is wrong.

Programs interrupted during file creation can leave a file owned by the 
effective user rather than the real user. Do not assume that a creat 
followed by a chown is safe.

Strip the program and install it with other mode "1" so strings
or a similar program cannot be used on it.

Consider logging the real uid, tty, time executed and program name each 
time the setuid program is run.

-- 
Jerry M. Carlin	(510) 823-2441 jmcarli@srv.pacbell.com
Alchemical Engineer and Virtual Realist