Article View: comp.security.misc
Article #510Re: Setuid script - is this unsecure?
From: Jurgen Botz
Date: Wed, 11 Nov 1992 04:04
Date: Wed, 11 Nov 1992 04:04
14 lines
1216 bytes
1216 bytes
In article <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> amoss@shuldig.cs.huji.ac.il (Amos Shapira) writes: >If you want an suid programme write it in C (even if it does dumb things) and >don't use the system(3) and popen(3) functions because they call /bin/sh and >hance it's almost like writing a shell script. I bet people can find some more >rules-of-thumb but these are the very basic ones you should follow. Or better yet, use Perl, which won't allow you to perform "unsafe" operations when running setuid. -- Jurgen Botz | Internet: JBotz@mtholyoke.edu Academic Systems Consultant | Bitnet: JBotz@mhc.bitnet Mount Holyoke College | Voice: (US) 413-538-2375 (daytime) South Hadley, MA, USA | Snail Mail: J. Botz, 01075-0629
Technical Details
Message-ID:
<BxJ9zK.Ltz@mtholyoke.edu>Path:
arc1-ca.pugleaf.net!sparky!uunet!news.mtholyoke.edu!jbotzReferences:
<1992Nov5.071354.24042@kth.se> <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il>Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!news.mtholyoke.edu!jbotz From: jbotz@mtholyoke.edu (Jurgen Botz) Subject: Re: Setuid script - is this unsecure? Message-ID: <BxJ9zK.Ltz@mtholyoke.edu> Sender: news@mtholyoke.edu (USENET News System) Organization: Mount Holyoke College References: <1992Nov5.071354.24042@kth.se> <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> Date: Wed, 11 Nov 1992 04:04:32 GMT Lines: 14