OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 4th quarter (Oct-Dec) 1994: Re: Setuid programs run from shell scripts?

Re: Setuid programs run from shell scripts?

Karl Strickland (karlbagpuss.demon.co.uk)
Wed, 16 Nov 1994 08:55:48 +0000 (GMT) 

> 
> > text deleted...
> > (Not to get into the set-UID shell-script argument again. ;-)
> > Clearly, the set-UID bit on one or the other must take precedence.
> > Someone, somewhere decided that it would be the set-UID bit on the
> > script.  This was maybe the wrong decision, but it's the one we're
> > stuck with, for the moment at least.
> > -----
> 
> Fred-
>     A shell script runs under the uid of the account executing it.
> I don't think there is any way for a script or any other subprocess
> to know whether it is being executed by any given account or by
> an account using a setuid program.

isnt that what real & effective uid's are for?!

> So the script suid has to take
> preference.

why?! i dont follow the logic.

> Unless you ignore suid on scripts altogether.
>
> Quentin

-- 
------------------------------------------+-----------------------------------
Mailed using ELM on FreeBSD               |                    Karl Strickland
PGP 2.3a Public Key Available.            | Internet: karlbagpuss.demon.co.uk
                                          |