Subject: Re: 'shutdown' setuid?
To: Simon Burge <simonb@wasabisystems.com>
From: Andrew Brown <atatat@atatdot.net>
List: netbsd-users
Date: 12/04/2002 02:06:28
>> Why is /sbin/shutdown setuid root on 1.6 and -current? (I haven't checked
>> any other versions.) The code ensures that it's running as root, which
>> is reasonable -- but if it's setuid, it always will be.
>>
>> (I agree that on single-user machines, it's a reasonable thing to do.
>> But the owner can do that on a per-machine basis.)
>
>It's also only executable by group operator:
>
> -r-sr-xr-- 1 root operator 270144 Aug 4 01:14 /sbin/shutdown*
>
>so operator folk can reboot the computer.
always was, afaict. the only thing that change recently (in '97) was
read permission being added for "other". i have no idea why.
--
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org * "ah! i see you have the internet
twofsonet@graffiti.com (Andrew Brown) that goes *ping*!"
werdna@squooshy.com * "information is power -- share the wealth."