Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Subject: Re: SUID wrapper (was Re: (fwd) Re: Format String Attacks)
From: Dan Harkless (dan-bugtraqDILVISH.SPEED.NET)
Date: Fri Sep 15 2000 - 03:48:19 CDT

"Granquist, Lamont" <lamontICOPYRIGHT.COM> writes:
> Instead of reinventing the wheel:
> http://cegt201.bradley.edu/~im14u2c/wrapper/
> That is Joe Zbiciak's suid wrapper which has been around for 3+ years.

I only looked at the source fairly briefly, but it looks like it can only
have one instance of a program with a given basename in its "wrap_profile".
If we're wrapping every system setid program on the machine, there's a quite
decent chance we'll need more than one instance of a given name. For
example, on Solaris 2.6 we need to wrap both /usr/bin/ps and /usr/ucb/ps.

I guess you could compile separate copies of this wrapper for the different
versions of ps, etc., but then you're back to a non-general-purpose wrapper
and you might as well shed a lot of unnecessary code and go with a simple
wrapper that hardcodes the path of the wrapped program.

Another thing is that the latest version of the wrapper generated by my
script eschews calls to functions like perror() and putenv() to be

Finally, there's something to be said for a wrapper that's so short you can
very quickly run through it in your mind and see that it does what you
expect. My script itself is not quite that short or simple, but the
wrappers it produces are, and it shows you the generated source code as it
compiles each one, and tells you what it's doing during each step of the

Dan Harkless | To prevent SPAM contamination, please
dan-bugtraqdilvish.speed.net | do not mention this private email
SpeedGate Communications, Inc. | address in Usenet posts. Thank you.