🚀 go-pugleaf

In article <1d6fdiINNf5q@bnsgd245.bnr.co.uk>, rickt@bnr.co.uk (Rick Tait) writes:
> I recently installed these shell scripts on my machine (on which I am root),
> and I'd like to know if I'm compromising it's security. Basically, they
> just allow the users to mount/umount/eject the floppy disk (pcfs).
> 
> In: (mount script)
> 
> #!/bin/sh --
> if ( test ${#} -eq 0 ) then
>     /usr/etc/mount -t pcfs /dev/fd0 /pcfs
>     else
>        if ( test ${1} = "ro" ) then
>          /usr/etc/mount -t pcfs -o ro /dev/fd0 /pcfs
>        else
>          if ( test ${1} = "rw" ) then
>            /usr/etc/mount -t pcfs /dev/fd0 /pcfs
>          else
>            echo Invalid argument -- not mounted
>          fi
>        fi
> fi
> 
> Out: (unmount/eject script)
> #!/bin/sh -- 
> /usr/etc/umount /pcfs
> eject
> 
> So do these make my system insecure? How? How the hell would a user
> turn these simple scripts over into something to compromise my IPX?

I don't think there will ever be a secure setuid shellscript:

Despite the fact  #!/bin/sh -- is much more better than #!/bin/sh
there are at least to holes in the script: 
First eject has no PATH so a user could write a malicious shellscript
with name /tmp/eject, cd to /tmp and set PATH to . :his shellscript will
then run under root.
Second you can fool /bin/sh to take every / as an blank and do the trick
above even if all cmds are preceeded by their full path.

Moral: don't use setuis shellscripts - write it in C or pearl instead.

Walter