🚀 go-pugleaf

In article <1992Nov5.071354.24042@kth.se> paf@cyklop.nada.kth.se (Patrik Fltstrm) writes:

   chiner@nova.gmi.edu writes:
   >(Rick Tait) writes:
   >: I recently installed these shell scripts on my machine (on which I am root),
   >: and I'd like to know if I'm compromising it's security. Basically, they
   >: just allow the users to mount/umount/eject the floppy disk (pcfs).
   >
   >:     /usr/etc/mount -t pcfs /dev/fd0 /pcfs
   >                            ^-o nosuid
   >:
   >and some other problems...  I'll point out, that all the mount commands
   >need a -o nosuid...  otherwise, anyone who can get a root shell on a disk,
   >can get root on your system...

I didn't see the entire thread from the beginning, but it seems to me you are
all missing the main problem with suid shell scripts, which is the bug in the
shell itself and the flexibility it offers with environment variables.

I can become root on your system using your /bin/sh script without even having
to know what it does or what programmes it calls.

suid shell script is a no-no. period.

If you want an suid programme write it in C (even if it does dumb things) and
don't use the system(3) and popen(3) functions because they call /bin/sh and
hance it's almost like writing a shell script.  I bet people can find some more
rules-of-thumb but these are the very basic ones you should follow.

A general suggestion for a programme which will do what you want would be:

main (ac, av)
	int ac;
	char **av;
{
	exec ("/usr/etc/mount", av);
}

and have the object of this C programme suid root.

Hope this helps,
--
--Amos Shapira (Jumper Extraordinaire)
C.S. System Group, Hebrew University, Jerusalem, Israel
amoss@cs.huji.ac.il