Out of curiosity looking for suid apps without special context on FC3

Out of curiosity looking for suid apps without special context on FC3

[Daniel J Walsh]

These are the files that do not have special context associated with 
them but are suid on FC3. 

/sbin/pwdb_chkpwd->system_u:object_r:sbin_t
/usr/lib/mc/cons.saver->system_u:object_r:lib_t
/usr/lib/mgetty+sendfax/faxq-helper->system_u:object_r:lib_t
/usr/lib/amanda/amqde->system_u:object_r:lib_t
/usr/lib/cyrus-imapd/deliver->system_u:object_r:bin_t
/usr/bin/kgrantpty->system_u:object_r:bin_t
/usr/bin/newvc->system_u:object_r:bin_t
/usr/bin/afppasswd->system_u:object_r:bin_t
/usr/bin/kon->system_u:object_r:bin_t
/usr/bin/nwsfind->system_u:object_r:bin_t
/usr/bin/fliccd->system_u:object_r:bin_t
/usr/bin/rcp->system_u:object_r:bin_t
/usr/bin/uustat->system_u:object_r:bin_t
/usr/bin/ncplogin->system_u:object_r:bin_t
/usr/bin/cu->system_u:object_r:bin_t
/usr/bin/sperl5.8.5->system_u:object_r:bin_t
/usr/bin/uucp->system_u:object_r:bin_t
/usr/bin/lppasswd->system_u:object_r:bin_t
/usr/bin/uux->system_u:object_r:bin_t
/usr/bin/ncpmap->system_u:object_r:bin_t
/usr/bin/rlogin->system_u:object_r:bin_t
/usr/bin/uuname->system_u:object_r:bin_t
/usr/bin/kpac_dhcp_helper->system_u:object_r:bin_t
/usr/bin/rsh->system_u:object_r:bin_t
/usr/sbin/exim->system_u:object_r:sbin_t
/usr/sbin/userisdnctl->system_u:object_r:sbin_t
/usr/sbin/uucico->system_u:object_r:sbin_t
/usr/sbin/uuxqt->system_u:object_r:sbin_t

# Asks for suid but seems to work.
/usr/bin/newgrp->system_u:object_r:bin_t

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Out of curiosity looking for suid apps without special context on FC3

[Thomas Bleher]

[-- Attachment #1: Type: text/plain, Size: 742 bytes --]

* Daniel J Walsh <dwalsh@redhat.com> [2004-09-30 22:08]:
> These are the files that do not have special context associated with 
> them but are suid on FC3. 
> 
> /usr/lib/mc/cons.saver->system_u:object_r:lib_t

This program is used to save output of previous run programs when
Midnight Commander is run in text mode on the Linux console (you can
toggle to it with C-o)
Nice functionality but not really essential. On Debian and strict SuSE
config the file has mode 0755.
Even though I use mc a lot I hadn't noticed till now so a case can
probably be made to remove the suid bit.

Thomas

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Out of curiosity looking for suid apps without special context on FC3

[Russell Coker]

On Fri, 1 Oct 2004 04:19, Daniel J Walsh <dwalsh@redhat.com> wrote:
> These are the files that do not have special context associated with
> them but are suid on FC3.
>
> /sbin/pwdb_chkpwd->system_u:object_r:sbin_t

I suspect that should have type chkpwd_exec_t, but would have to do some tests 
and code inspection.  I expect that it won't work without PAM code changes 
anyway.

> # Asks for suid but seems to work.
> /usr/bin/newgrp->system_u:object_r:bin_t

Only in targeted policy or as sysadm_t.  In strict policy as a regular user it 
fails.  I guess I have to create user_newgrp_t etc domains, and policy for 
gpasswd.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.