[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: suid



>if you write a suid root script without thinking to much, it is badbut if
>you think carefully before doing so, it is not bad, and an easy solution
>to some problems ( better then giving the root password )
You can name solution that is *worse* than giving a root password to
a stranger? ;) Well, publishing it in Maariv with page-size ad, maybe.... 
Now think of your script run with wrong (or _right_, depending on the
side you are on ;) pathes and libs, or just set current directory (or some 
of the environment vars it uses) to something veeery long and see how csh
and others are protected from buffer overflows... plain old shell is not
nearly secure enough to run something as root, if not run by root itself.

>so can I or can't I make suid root scripts in tcsh ?
AFAIK you can't. But if you find how to do it, just DON'T. And if you
still decide to do, NEVER tell me (or anyone) where it is - temptation may
be too big for a human >;)) 
--
frodo@sharat.co.il	\/  There shall be counsels taken
Stanislav Malyshev	/\  Stronger than Morgul-spells
phone +972-2-5369213	/\  		JRRT LoTR.
http://www.sharat.co.il/frodo/   whois:SM719-RIPE@whois.ripe.net