* Out of curiosity looking for suid apps without special context on FC3 @ 2004-09-30 18:19 Daniel J Walsh 2004-09-30 20:22 ` Thomas Bleher 2004-09-30 20:32 ` Russell Coker 0 siblings, 2 replies; 3+ messages in thread From: Daniel J Walsh @ 2004-09-30 18:19 UTC (permalink / raw) To: SELinux These are the files that do not have special context associated with them but are suid on FC3. /sbin/pwdb_chkpwd->system_u:object_r:sbin_t /usr/lib/mc/cons.saver->system_u:object_r:lib_t /usr/lib/mgetty+sendfax/faxq-helper->system_u:object_r:lib_t /usr/lib/amanda/amqde->system_u:object_r:lib_t /usr/lib/cyrus-imapd/deliver->system_u:object_r:bin_t /usr/bin/kgrantpty->system_u:object_r:bin_t /usr/bin/newvc->system_u:object_r:bin_t /usr/bin/afppasswd->system_u:object_r:bin_t /usr/bin/kon->system_u:object_r:bin_t /usr/bin/nwsfind->system_u:object_r:bin_t /usr/bin/fliccd->system_u:object_r:bin_t /usr/bin/rcp->system_u:object_r:bin_t /usr/bin/uustat->system_u:object_r:bin_t /usr/bin/ncplogin->system_u:object_r:bin_t /usr/bin/cu->system_u:object_r:bin_t /usr/bin/sperl5.8.5->system_u:object_r:bin_t /usr/bin/uucp->system_u:object_r:bin_t /usr/bin/lppasswd->system_u:object_r:bin_t /usr/bin/uux->system_u:object_r:bin_t /usr/bin/ncpmap->system_u:object_r:bin_t /usr/bin/rlogin->system_u:object_r:bin_t /usr/bin/uuname->system_u:object_r:bin_t /usr/bin/kpac_dhcp_helper->system_u:object_r:bin_t /usr/bin/rsh->system_u:object_r:bin_t /usr/sbin/exim->system_u:object_r:sbin_t /usr/sbin/userisdnctl->system_u:object_r:sbin_t /usr/sbin/uucico->system_u:object_r:sbin_t /usr/sbin/uuxqt->system_u:object_r:sbin_t # Asks for suid but seems to work. /usr/bin/newgrp->system_u:object_r:bin_t -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Out of curiosity looking for suid apps without special context on FC3 2004-09-30 18:19 Out of curiosity looking for suid apps without special context on FC3 Daniel J Walsh @ 2004-09-30 20:22 ` Thomas Bleher 2004-09-30 20:32 ` Russell Coker 1 sibling, 0 replies; 3+ messages in thread From: Thomas Bleher @ 2004-09-30 20:22 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SELinux [-- Attachment #1: Type: text/plain, Size: 742 bytes --] * Daniel J Walsh <dwalsh@redhat.com> [2004-09-30 22:08]: > These are the files that do not have special context associated with > them but are suid on FC3. > > /usr/lib/mc/cons.saver->system_u:object_r:lib_t This program is used to save output of previous run programs when Midnight Commander is run in text mode on the Linux console (you can toggle to it with C-o) Nice functionality but not really essential. On Debian and strict SuSE config the file has mode 0755. Even though I use mc a lot I hadn't noticed till now so a case can probably be made to remove the suid bit. Thomas -- http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA D09E C562 2BAE B2F4 ABE7 [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 189 bytes --] ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Out of curiosity looking for suid apps without special context on FC3 2004-09-30 18:19 Out of curiosity looking for suid apps without special context on FC3 Daniel J Walsh 2004-09-30 20:22 ` Thomas Bleher @ 2004-09-30 20:32 ` Russell Coker 1 sibling, 0 replies; 3+ messages in thread From: Russell Coker @ 2004-09-30 20:32 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SELinux On Fri, 1 Oct 2004 04:19, Daniel J Walsh <dwalsh@redhat.com> wrote: > These are the files that do not have special context associated with > them but are suid on FC3. > > /sbin/pwdb_chkpwd->system_u:object_r:sbin_t I suspect that should have type chkpwd_exec_t, but would have to do some tests and code inspection. I expect that it won't work without PAM code changes anyway. > # Asks for suid but seems to work. > /usr/bin/newgrp->system_u:object_r:bin_t Only in targeted policy or as sysadm_t. In strict policy as a regular user it fails. I guess I have to create user_newgrp_t etc domains, and policy for gpasswd. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2004-09-30 20:32 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2004-09-30 18:19 Out of curiosity looking for suid apps without special context on FC3 Daniel J Walsh 2004-09-30 20:22 ` Thomas Bleher 2004-09-30 20:32 ` Russell Coker
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.