🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #835

Re: Setuid script - is this unsecure?

#835
From: J{rvinen Hannu-Matti
Date: Mon, 23 Nov 1992 09:34
26 lines
1601 bytes
>>Equivalent would be that you let anybody execute mount (i.e., set
>>mount suid), which is not reasonable. Also you have to deny suid
>>programs on the floppy, and ensure that there does not exist special
>>devices on the floppy.

>>I've written a set of programs (fdmkfs, fdmount, and fdumount) to give
>>users access to the floppy. They are available by anonymous ftp on
>>site cs.tut.fi (130.230.4.2), file pub/src/tut/floppy.shar. Use on
>>your own risk.

>Everybode executing mount isn't indeed a good idea:
>How about mount /dev/fd /etc

That's exactly what I meant - perhaps I was not too clear. The orignal
C-code above lets anybody to execute mount as a suid-program, which is
equivalent to set mount suid.

My set of programs mount /dev/fd0c always on /floppy/disk to avoid
such problems. They also set privileges of /dev/fd0* and
/dev/rfd0* to prevent creation of devices using editors after the
mount.
-- 
-----
Hannu-Matti Jarvinen, hmj@cs.tut.fi
Opinions of tut != opinions of mine, and vice versa.
TTKK on samaa mielt{ kanssani siit{, ett{ en edusta sen mielipidett{.
Technical Details
Message-ID: <1eq8idINNof0@cs.tut.fi>
Path: arc1-ca.pugleaf.net!sparky!uunet!mcsun!news.funet.fi!news.cs.tut.fi!hmj
References: <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> <1eg5tmINN9eh@cs.tut.fi> <1992Nov20.135059.24347@fwi.uva.nl>

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!mcsun!news.funet.fi!news.cs.tut.fi!hmj
From: hmj@cs.tut.fi (J{rvinen Hannu-Matti)
Newsgroups: comp.security.misc
Subject: Re: Setuid script - is this unsecure?
Date: 23 Nov 1992 09:34:05 GMT
Organization: Tampere University of Technology
Lines: 26
Distribution: world
Message-ID: <1eq8idINNof0@cs.tut.fi>
References: <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> <1eg5tmINN9eh@cs.tut.fi> <1992Nov20.135059.24347@fwi.uva.nl>
NNTP-Posting-Host: kuukkeli.cs.tut.fi