<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body dir="ltr" bgcolor="#ffffff" text="#000000">
<br>
Oron Peled wrote:
<blockquote cite="mid:200904231016.16284.oron@actcom.co.il" type="cite"><br>
<pre wrap="">
There's a reason why the kernel does not respect suid/sgid bit on shell
scripts -- It's because there are gazillions of ways a user can use
this script to gain total root access.
</pre>
</blockquote>
Name two?<br>
<blockquote cite="mid:200904231016.16284.oron@actcom.co.il" type="cite"><br>
<pre wrap="">
Maybe writing a wrapper suid program that totally sanitize
both the environment and command line arguments before
exec'ing the script would make it. Although I wouldn't bet
on it since it only covers the obvious attack vectors against
shell scripts.
</pre>
</blockquote>
Fine. Make the two cover these obvious vectors, one each.<br>
<br>
I have to say that I first heard about this restriction, I thought it
made a lot of sense. Since then, I have searched for these famed attack
vectors, and have come up short. Sure, if the script itself has
security holes, then a suid script will be vulnerable. As I'm sure you
know well, this is also true of C written code, however.<br>
<br>
So my question is: are there attack vectors against the following
script?<br>
<br>
#!/bin/sh -e<br>
<br>
echo "Hello, cruel world"<br>
<pre class="moz-signature" cols="72">--
Shachar Shemesh
Lingnu Open Source Consulting Ltd.
<a class="moz-txt-link-freetext" href="http://www.lingnu.com">http://www.lingnu.com</a>
</pre>
</body>
</html>