🚀 go-pugleaf

buzz@toxicavenger.bear.com (Buzz Moschetti) writes:

>We wish to make mount and umount available to two or three non-root accounts.
>The plan is create a C code fork/exec wrapper that does the following:

>	1.  Verifies that the euid is root.
>	2.  Verifies that the uid is one of the "privileged" users.
>	3.  Forces argv[0] to be /usr/etc/(u)mount.
>	4.  Does an execv(3) -- NOT execvp(3) -- to run the argv.

>The program itself is setuid root, mode 4711, so that the binary image
>cannot be copied and compromised:
>	-rws--x--x  1 root        24576 Aug 17 11:51 mmount

>I believe this to be secure.  Can someone claim otherwise?
Additionally, you should make some provisions, that the filesystems
which could be mounted by the users could be only mounted with option "nosuid".
(This forbids setuid execution on those mountpoints).

If your system doesn't support that option, you are in trouble.
Its really no problem for an advanced user, to put a sh onto a
floppy, and make it setuid root. You could forbid access to the raw
floppy, so that nobody could fiddle around with an unmounted filesystem,
but that's no real security, as you could fiddle with the bits on any dump PC.

Sincerely,
Klaus Steinberger

--
Klaus Steinberger               Beschleunigerlabor der TU und LMU Muenchen
Phone: (+49 89)3209 4287        Hochschulgelaende
FAX:   (+49 89)3209 4280        D-8046 Garching, Germany
Internet: Klaus.Steinberger@Physik.Uni-Muenchen.DE