Oron Peled wrote:
There's a reason why the kernel does not respect suid/sgid bit on shell
scripts -- It's because there are gazillions of ways a user can use
this script to gain total root access.
Name two?
Maybe writing a wrapper suid program that totally sanitize
both the environment and command line arguments before
exec'ing the script would make it. Although I wouldn't bet
on it since it only covers the obvious attack vectors against
shell scripts.
Fine. Make the two cover these obvious vectors, one each.
I have to say that I first heard about this restriction, I thought it
made a lot of sense. Since then, I have searched for these famed attack
vectors, and have come up short. Sure, if the script itself has security
holes, then a suid script will be vulnerable. As I'm sure you know well,
this is also true of C written code, however.
So my question is: are there attack vectors against the following script?
#!/bin/sh -e
echo "Hello, cruel world"
--
Shachar Shemesh
Lingnu Open Source Consulting Ltd.
http://www.lingnu.com
_______________________________________________
Linux-il mailing list
Linux-il@cs.huji.ac.il
http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il
