Guy Helmer wrote:
> > On Jul 9, 2018, at 6:54 AM, Julian H. Stacey <j...@berklix.com> wrote:
> > Hi current@
> > I want to add su to /rescue, but got stuck on pam.
> > Old unix su didn't suffer from pam.
> > There's no #define in su to turn off pam.
> > Man src.conf says WITHOUT_PAM is deprecated & does nothing.
> >
> > Can someone please offer a solution ?
> > Or better to include a simple BSD su pre pam ?
> > I would happily develop a patch for that.
> Hi,
> Aside from not being able to use pam from a static executable, please donât
> try to make the crunched hard-linked executable in /rescue setuid-root (su is
> useless without it). That would mean anyone running /rescue/sh gets a root
> shell :-)
Thanks Guy ! Yes all SUID 0 would be very wrong.
> Conceptually, a separate crunchgen binary could be made for setuid-root
> purposes, but having a setuid-root binary in /rescue (outside of the normal
> hierarchy) makes me nervous.
In case other suid things are also needed later, I created a local
src/rescue/suid/ with an old su.c pre PAM, Thanks to Diane Bruce,
& a diff & Makefile to drive it.
http://berklix.com/~jhs/src/bsd/fixes/freebsd/src/gen/rescue/
It works, but improvements welcome.
Cheers,
Julian
--
Julian Stacey, Computer Consultant, Systems Engineer, BSD Linux Unix, Munich
Brexit Referendum stole 3.7 million votes inc. 700,000 from British in EU.
UK Goverment lies it's democratic in Article 50 paragraph 3 of letter to EU.
http://exitbrexit.uk
_______________________________________________
freebsd-current@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
