Article View: comp.security.misc
Article #468Re: Setuid script - is this unsecure?
From: Wietse Venema
Date: Fri, 06 Nov 1992 08:44
Date: Fri, 06 Nov 1992 08:44
19 lines
1262 bytes
1262 bytes
rickt@bnr.co.uk (Rick Tait) writes: >I recently installed these shell scripts on my machine (on which I am root), >and I'd like to know if I'm compromising it's security. Basically, they >just allow the users to mount/umount/eject the floppy disk (pcfs). I suggest that you read the FAQ which is posted at regular intervals, and which can be ftp-ed from many sites (ask archie). A trivial hole: the scripts do not set PATH, and /usr/etc/mount relies on PATH to execute other commands. The non-trivial hole: switching files after the kernel has started a root shell, but before that shell has opened the the shell script file. This, and more, is discussed in the FAQ document. The alternative: the MTOOLS package that does not require the mounting of MS-DOS disks. Wietse
Technical Details
Message-ID:
<4072@wzv.win.tue.nl>Path:
arc1-ca.pugleaf.net!sparky!uunet!spool.mu.edu!yale.edu!ira.uka.de!math.fu-berlin.de!news.netmbx.de!Germany.EU.net!mcsun!sun4nl!tuegate.tue.nl!svin09!wzv!wietseReferences:
<1d6fdiINNf5q@bnsgd245.bnr.co.uk>Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!spool.mu.edu!yale.edu!ira.uka.de!math.fu-berlin.de!news.netmbx.de!Germany.EU.net!mcsun!sun4nl!tuegate.tue.nl!svin09!wzv!wietse From: wietse@wzv.win.tue.nl (Wietse Venema) Newsgroups: comp.security.misc Subject: Re: Setuid script - is this unsecure? Message-ID: <4072@wzv.win.tue.nl> Date: 6 Nov 92 08:44:16 GMT References: <1d6fdiINNf5q@bnsgd245.bnr.co.uk> Organization: Eindhoven University of Technology, The Netherlands Lines: 19