Re: SETUID perl script leaves backdoor open after dropping privileges

On Wed, Apr 25, 2012 at 07:15, Christopher Zimmermann wrote: > As requested, here's the same test case a little more readable: > > This leaves a backdoor open (possibly in the saved UID): Yes, if you don't clear the saved uid, you can still switch back to it. You should use setresuid if it's ava

Re: SETUID perl script leaves backdoor open after dropping privileges

As requested, here's the same test case a little more readable: This leaves a backdoor open (possibly in the saved UID): == #!/usr/bin/perl -wT use strict; use English qw(-no_match_vars); sub ids { print "RUID=$REAL_USER_ID EUID=$EFFECTIVE_USER_ID\n" } ids;