🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #844

Re: Setuid script - is this unsecure?

#844
From: Steven Leikeim
Date: Mon, 23 Nov 1992 16:52
34 lines
2160 bytes
In article <1eg5tmINN9eh@cs.tut.fi> hmj@cs.tut.fi (J{rvinen Hannu-Matti) writes:
>Equivalent would be that you let anybody execute mount (i.e., set
>mount suid), which is not reasonable. Also you have to deny suid
>programs on the floppy, and ensure that there does not exist special
>devices on the floppy.
>
>I've written a set of programs (fdmkfs, fdmount, and fdumount) to give
>users access to the floppy. They are available by anonymous ftp on
>site cs.tut.fi (130.230.4.2), file pub/src/tut/floppy.shar. Use on
>your own risk.
>
>-- 
>-----
>Hannu-Matti Jarvinen, hmj@cs.tut.fi
>Opinions of tut != opinions of mine, and vice versa.
>TTKK on samaa mielt{ kanssani siit{, ett{ en edusta sen mielipidett{.

Another set of programs which I have used is mntdisk. This was posted in
comp.sources.unix volume 22, and is available from many ftp sites. It includes
support for diskettes UNIX and PC formats (at least on Suns), CD's and
Erasable Optical Disks. It attempts to make sure that you do not mount
diskettes with device files and mounts with the nosuid option to prevent
misuse of diskettes.

As shipped it lets you mount the diskette wherever you like. However, it
is easy to modify to only allow mounts on specific directories if this is
necessary.


-- 
Steven Leikeim                        |
University of Calgary                 |   There are lies, damned lies,
Department of Electrical Engineering  |        and statistics.
Internet: steven@enel.ucalgary.ca     |
Technical Details
Message-ID: <92Nov23.165237.13903@acs.ucalgary.ca>
Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!sol.ctr.columbia.edu!destroyer!cs.ubc.ca!unixg.ubc.ca!kakwa.ucs.ualberta.ca!acs.ucalgary.ca!steven
References: <1992Nov5.071354.24042@kth.se> <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> <1eg5tmINN9eh@cs.tut.fi>

Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc
Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!sol.ctr.columbia.edu!destroyer!cs.ubc.ca!unixg.ubc.ca!kakwa.ucs.ualberta.ca!acs.ucalgary.ca!steven
From: steven@enel.ucalgary.ca (Steven Leikeim)
Subject: Re: Setuid script - is this unsecure?
Sender: news@acs.ucalgary.ca (USENET News System)
Message-ID: <92Nov23.165237.13903@acs.ucalgary.ca>
Date: Mon, 23 Nov 92 16:52:37 GMT
References: <1992Nov5.071354.24042@kth.se> <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> <1eg5tmINN9eh@cs.tut.fi>
Nntp-Posting-Host: mcp.enel.ucalgary.ca
Organization: ECE Department, U. of Calgary, Calgary, Alberta, Canada
Lines: 34