🚀 go-pugleaf

In article <1d6fdiINNf5q@bnsgd245.bnr.co.uk> rickt@bnr.co.uk (Rick Tait) writes:
>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).

instead of a shell script try this C program:

Note the the real way it to run "check -s" on the unix file system first
also an attack is still possible if you edit (adb) the raw device
after the floppy is mounted and create a specal device (eg: mem of kmem)



#include <stdio.h>

/*

Note: /etc/fstab should contain the following:

/dev/fd0   /pcfs       pcfs rw,noauto 0 0
/dev/fd0   /floppy  4.2 rw,noauto,nosuid 0 0
*/



static char by[] = "@(#) pcfs.c Pete Shipley [1991]\n";

static char *mount = "/usr/etc/mount";
static char *umount = "/usr/etc/umount";

static char *where = "/pcfs";
static char *what = "/dev/fd0";

static char *use ="Usage: %s [ -u | -d | -m ]\n\
\t-d\tmount MS-DOS diskette\n\
\t-m\tmount unix diskette\n\
\t-u\tunmount diskette\n";

extern int strncmp(), setuid(), perror(), fprintf(), getuid();
extern void execl();

int
main(ac, av)
char *av[];
int ac;
{
char *cp;
char  **cpp;
extern char **environ;

    if(ac != 2) goto error;


    for (cpp = environ; cp = *cpp; /* void */) {
        char  **xpp;

        if(strncmp(cp, "LD_", 3) == 0) {
            for (xpp = cpp; xpp[0] = xpp[1]; xpp++);
        } else {
            cpp++;
        }
    }


    /* not nessary
    if( setuid(getuid()) == -1) {
	(void) perror("setuid");
	exit(1);
    } */

    switch(av[1][1]) {
	case 'u':
	    execl(umount, umount, where, (char *)0);
	case 'd':
	    execl(mount, mount, "-t", "pcfs", what, where, (char *)0);
	case 'm':
	    execl(mount, mount, "-t", "4.2", "-o", "nosuid", what, where, (char *)0);
error:
	default:
	    (void) fprintf(stderr, use, av[0]);
	    exit(1);
    }
    exit(0);
}

-- 
---------------
Pete Shipley:
email: shipley@berkeley.edu             Flames:  cimarron@postgres.berkeley.edu
Spelling corections: /dev/null          Quote: "Anger is an energy"