Re: [PATCH] Fix busybox SUID support

[Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>]

On Fri, Feb 26, 2010 at 12:21:56PM -0800, C Michael Sundius wrote:
>On Fri, Feb 26, 2010 at 10:20 AM, Koen Kooi <k.kooi@student.utwente.nl>wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 26-02-10 16:43, Mike Westerhof wrote:
>> > Tom Rini wrote:
>> >> I was about to just push this and I noticed that a number of
>> >> distributions (SlugOS, Angstrom, Kaelios, micro) currently set
>> >> FEATURE_SUID=y, but it's not actually install SUID.  And since I recall
>> >> some way-back-when's of "busybox SUID is dangerous / crap!", I thought
>> >> it best to post the patch first and let folks speak up / ask me to drop
>> >> FEATURE_SUID=y when I do this.  So, here's the patch:
>> >
>> > In the case of SlugOS, this was deliberate -- the thinking was that we
>> > would let the user decide if they wanted to run busybox SUID after
>> > installation.  In retrospect, that actually led to more problems than
>> > good, so this change gets an ACK from me (albeit late - sorry for the
>> > delay!)
>>
>> The same logic was applied to angstrom "let users sort it out", but I
>> think this patch is a better way to go.
>>
>>
>just to give you a heads up, we're currently working on a patch to busybox
>(and well have an OE recipe for it too) which will allow us to currently
>create two busybox executables: busybox-suid and busybox-nsuid. this way we
>can have the best of both worlds. maintain suid for programs that really
>require it while keeping the likes of ls and cat safe for the masses...

SUID_DROP applets do just that before the individual applet_main is called,
i.e. drops privs. But whatever..
If you really think you want to build the thing twice then i'd try
FEATURE_SHARED_BUSYBOX, fyi.
$ size 0_lib/{busybox,libbusybox.so.1.17.0.git}
   text	   data	    bss	    dec	    hex	filename
   1379	    520	     16	   1915	    77b	0_lib/busybox
 339569	   6705	   8552	 354826	  56a0a	0_lib/libbusybox.so.1.17.0.git

duplicating 2k is better than duplicating all the innocent rest, but maybe
that's just me..

cheers,

>once its through our internal review, we'll send it out.