🚀 go-pugleaf

rickt@bnr.co.uk (Rick Tait) writes:
: I recently installed these shell scripts on my machine (on which I am root),
: and I'd like to know if I'm compromising it's security. Basically, they
: just allow the users to mount/umount/eject the floppy disk (pcfs).

:     /usr/etc/mount -t pcfs /dev/fd0 /pcfs
                            ^-o nosuid
:          /usr/etc/mount -t pcfs -o ro /dev/fd0 /pcfs
                                       ^nosuid
:            /usr/etc/mount -t pcfs /dev/fd0 /pcfs
                                   ^-o nosuid

: So do these make my system insecure? How? How the hell would a user
: turn these simple scripts over into something to compromise my IPX?
: 
Other people on here will point out many problems with suid scripts,
and some other problems...  I'll point out, that all the mount commands
need a -o nosuid...  otherwise, anyone who can get a root shell on a disk,
can get root on your system...  Is there any particular reason that people
need to store things on floppies?  could mtools be used instead? 
storing things on a MS-DOS disk makes it easier...
just make sure that eject is world executable... so that people don't
have to use the l1-a,n,eject method...

--
Chris Hiner   chiner@nova.gmi.edu
Signature file temporarily unavailable
Abort, Retry, Fail?