🚀 go-pugleaf

smb@ulysses.att.com (Steven Bellovin) writes:

>In article <MELLAN.92Nov17131950@syst06.acri.fr>, mellan@syst06.acri.fr (Alain Mellan) writes:
>> 
>> I just discovered today that gnumake is installed with SGID bit, and
>> belongs to user root, group kmem.
>> 
>> Am I right to be suspicious ?  The kmem SGID will allow gnumake to
>> read into /dev/kmem the info needed for load balancing, but is that
>> all?

>Someone who can read /dev/kmem can also read interesting things like
>typed passwords in tty input buffers, and disk blocks from read-protected
>files.  I have no idea whether or not it's possible to trick gnumake
>into doing those things -- for example, if it doesn't properly reset
>its setgidness and close the file descriptor before execing a user program.
>There's a definite risk here, if things weren't done properly.

I guess if you are worried you should simply RTFC (after all, gnumake *is*
public domain -- but because of this fact I would doubt any security holes
would go unnoticed this long).  You could also try one of the gnu groups.