Article View: comp.security.misc
Article #835Re: Setuid script - is this unsecure?
From: J{rvinen Hannu-Matti
Date: Mon, 23 Nov 1992 09:34
Date: Mon, 23 Nov 1992 09:34
26 lines
1601 bytes
1601 bytes
>>Equivalent would be that you let anybody execute mount (i.e., set
>>mount suid), which is not reasonable. Also you have to deny suid
>>programs on the floppy, and ensure that there does not exist special
>>devices on the floppy.
>>I've written a set of programs (fdmkfs, fdmount, and fdumount) to give
>>users access to the floppy. They are available by anonymous ftp on
>>site cs.tut.fi (130.230.4.2), file pub/src/tut/floppy.shar. Use on
>>your own risk.
>Everybode executing mount isn't indeed a good idea:
>How about mount /dev/fd /etc
That's exactly what I meant - perhaps I was not too clear. The orignal
C-code above lets anybody to execute mount as a suid-program, which is
equivalent to set mount suid.
My set of programs mount /dev/fd0c always on /floppy/disk to avoid
such problems. They also set privileges of /dev/fd0* and
/dev/rfd0* to prevent creation of devices using editors after the
mount.
--
-----
Hannu-Matti Jarvinen, hmj@cs.tut.fi
Opinions of tut != opinions of mine, and vice versa.
TTKK on samaa mielt{ kanssani siit{, ett{ en edusta sen mielipidett{.
Technical Details
Message-ID:
<1eq8idINNof0@cs.tut.fi>Path:
arc1-ca.pugleaf.net!sparky!uunet!mcsun!news.funet.fi!news.cs.tut.fi!hmjReferences:
<AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> <1eg5tmINN9eh@cs.tut.fi> <1992Nov20.135059.24347@fwi.uva.nl>Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!mcsun!news.funet.fi!news.cs.tut.fi!hmj
From: hmj@cs.tut.fi (J{rvinen Hannu-Matti)
Newsgroups: comp.security.misc
Subject: Re: Setuid script - is this unsecure?
Date: 23 Nov 1992 09:34:05 GMT
Organization: Tampere University of Technology
Lines: 26
Distribution: world
Message-ID: <1eq8idINNof0@cs.tut.fi>
References: <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> <1eg5tmINN9eh@cs.tut.fi> <1992Nov20.135059.24347@fwi.uva.nl>
NNTP-Posting-Host: kuukkeli.cs.tut.fi