tech-userlevel archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Adding a simple editor to the base system



> > I never tried it myself but my guess is [...]
> 
> I suppose actually looking to see what it does is out of the question?
I don't actually *need* setuid scripts, so I didn't waste time recompiling
the kernel only to see what it does. I just remember there was SETUIDSCRIPTS,
that's all.

> > How do you think the kernel could prevent symlink attacks?  I'm
> > curious to know.
> 
> By not passing a name attackers can symlink-replace, of course - such
> as by (see above) opening the script file in the kernel and passing the
> shell an fd already open onto it.
Yes, that's what options(4) says too. I didn't know there's FDSCRIPTS though.
Thank you for your explanation.




Home | Main Index | Thread Index | Old Index