Re: set-uid on shell scripts in Solaris

Posted in 1994

Chris Davies — Thu, 21 Jul 1994 11:30:12 GMT — source: Informix-list mailing list archive (1991-1998)

Jack Parker (jparker@hpbs3645.boi.hp.com) wrote: : We have a script [...that...] is set to -rwsr-sr-x. (At least I think this is what he said; I've paraphrased it somewhat.) Pretty much all of you using setuid shell scripts on UNIX boxes have opened up a real security hole. It's trivially possible to gain the priviledges associated with your script in moments (i.e. a setuid-root script ==> root access). The principal exceptions are scripts that are executed via some other compiled setuid program (eg those supplied with perl and ksh). !! Chris -- VISIONWARE LTD, 57 Cardigan Lane, LEEDS LS4 2LE, England Tel +44 532 788858. Fax +44 532 304676. Email chrisd@visionware.co.uk -------- "Visionware: The home of DOS/SQL/UNIX/X/VMS integration" --------