> In the past few weeks I've had a lot of problems with various
> binaries losing their suid bits. For example, I upgraded smail
> to the latest (package), and started getting errors from smail
> telling me it couldn't write to the paniclog. It wasn't suid,
> as it should've been. A few people have told me in mail that
> this is a Linux 2.1 bug.
I don't think so. I suspect this is a bug in the version of dpkg
you're using. Please check if the setuid bit is set in the '.deb'
file: dpkg-deb --contents smail*deb; if it is, and it is not
present after "dpkg -i smail*deb", it is definitively a problem
with your dpkg version.
> However I spoke to someone on the kernel mailing list, and he
> said that as far as he knew, it was a feature, and is
> in most unixes and to his knowledge even Linux 2.0. To my
> testing it is not in Linux 2.0, but it is in Solaris 5.5,
> for example.
No. This is about setuid _scripts_. Setuid scripts are a security
hole on almost every system, because of a time window in which the
script might be replaced after the setuid has gone effective, but
before the interpreter has read it. Solaris is free from this hole.
In linux, setuid bits on _scripts_ are ignored.
Hope this helps,
Ray
--
J.H.M. Dassen | RUMOUR Believe all you hear. Your world may
[EMAIL PROTECTED] | not be a better one than the one the blocks
| live in but it'll be a sight more vivid.
| - The Hipcrime Vocab by Chad C. Mulligan
--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
[EMAIL PROTECTED] . Trouble? e-mail to [EMAIL PROTECTED]
