Re: Setuid file

Article View: comp.security.misc

Article #492

Back to comp.security.misc Previous Next

#492

From: Ryan A. Whelan
Date: Mon, 09 Nov 1992 07:30

19 lines
1245 bytes

In article <1992Nov3.211052.11569@ulysses.att.com> smb@ulysses.att.com (Steven Bellovin) writes:
>I've never heard of shells themselves running setuid, and I hope I never
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

>do...  Ksh uses a setuid root intermediate program to implement setuid
>shell scripts on systems where the kernel doesn't do it.  It uses
>open file descriptors, rather than names, and so should be immune
>to the usual hack.
>
>So -- I don't know of any problems with that file.  But I confess that
>it makes me extremely nervous -- I just have a very bad feeling about it...


really? Never?


-- 
Ryan A. Whelan                      "Repetition does not establish validity."
rwhelan@gmuvax2.gmu.edu                                         - Souder's Law

Technical Details

Message-ID: <1992Nov9.073026.26118@gmuvax2.gmu.edu>

Path: arc1-ca.pugleaf.net!sparky!uunet!haven.umd.edu!news.umbc.edu!gmuvax2!rwhelan

References: <8exLmiW00WB6QXP4Yb@andrew.cmu.edu> <21806@rpp386.lonestar.org> <1992Nov3.211052.11569@ulysses.att.com>

Show Full Headers

Complete Article Headers

Newsgroups: comp.security.misc
Path: arc1-ca.pugleaf.net!sparky!uunet!haven.umd.edu!news.umbc.edu!gmuvax2!rwhelan
From: rwhelan@gmuvax2.gmu.edu (Ryan A. Whelan)
Subject: Re: Setuid file
Message-ID: <1992Nov9.073026.26118@gmuvax2.gmu.edu>
Organization: George Mason University, Fairfax, Va.
References: <8exLmiW00WB6QXP4Yb@andrew.cmu.edu> <21806@rpp386.lonestar.org> <1992Nov3.211052.11569@ulysses.att.com>
Date: Mon, 9 Nov 1992 07:30:26 GMT
Lines: 19

Reply to Parent Message