From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christian Robottom Reis Subject: readdir and checksecurity Date: Wed, 24 Mar 2004 10:55:08 -0300 Sender: linux-admin-owner@vger.kernel.org Message-ID: <20040324135507.GA940@async.com.br> Mime-Version: 1.0 Return-path: Content-Disposition: inline List-Id: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: linux-admin@vger.kernel.org Cc: debian-security@lists.debian.org Hi there, one of our servers (which runs Debian Woody) was recently compromised, and had a suckit variant installed. We've gone through the reinstall and restore steps, and one of the things I looked at is debian's /usr/sbin/checksecurity script, which checks for changes in setuid files. Now suckit alters the system call table to provide specific functionality to the attacker; one of these is to make specified files and directories invisible to readdir(3) through a hacked getdents(2) proxy function. My question is: doesn't this situation sort of invalidate checksecurity's setuid check, since setuid files that are in "hidden" directories won't show up in the listing? Take care, -- Christian Robottom Reis | http://async.com.br/~kiko/ | [+55 16] 261 2331