From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3D4927702E for ; Mon, 1 Dec 2025 21:39:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764625186; cv=none; b=uQJBuEPBGDQ02A5TG7X+qM/oBL76172/3NdjK3Zre4kPhRF1FtyMzuJx5yx1/fe7Ukd2NV4dJo0hZ65QZsz3GtqOI789m4AMfK/hySQgvntJ3CNMLOVtfRGAm7AcZG/m6KKcXvLteLV+imsx/E3lJ5R1B7YrddJAU7q23azIWY0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764625186; c=relaxed/simple; bh=/RkCgTE/4Sl75hR0rlbGxd11uecUwoBDhtpuhsWfVcA=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cgSzw7NSyhB5yyb61hnNnen727fhulTUdIsLuoeEl4cePtdTRHblbVLxZca47fujyvK+YfSuu7T5okj418mQ2ytJv93kKISqUEJZu11mpwXDBkDmWE1EhKHLDtePEg7nRi+jidYXDtmXdnvMZQqIpkhVwmnfOHQRmHv0MTK43ak= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Xgs+HtWy; arc=none smtp.client-ip=209.85.221.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Xgs+HtWy" Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-42b38de7940so2329886f8f.3 for ; Mon, 01 Dec 2025 13:39:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764625183; x=1765229983; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=uZmRqhdDnonRvflYIO2SfgDWhvVya0E7TMh9w4AtTjQ=; b=Xgs+HtWyK5MQ/jnUBr+KIXECHApj+OALgOKz5VtDzjPSEoR5FInlvgHiZtFUB3z1kK U4lUkEBt5mnvZLshW54S4+8YTzEZtZ6xV6iL6RlCQhyCKa9PUBMlbcaf5cBv3v6RMJ1s BFQZM+CZZH4u+O8+faUtrMkIZZLphrZfzjqqFvlOyCq7oRa3HEfnaZ/douzRMaStvpzp CVNlJUKb235ZbLDqxyhtbaloqGaEjUXjATUGSNNLSg9X7KtXzm8EgJszk0ucghsmrLGc ZqDG7pOo5kKkOtEeCb+B1CNyQKzGISircodxMAwfMv+8qB6Xhg+88+xdEq/Tr9C5cCeU ZUDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764625183; x=1765229983; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=uZmRqhdDnonRvflYIO2SfgDWhvVya0E7TMh9w4AtTjQ=; b=q612fAiePR7InI0g9KxkcVkVyxAnSnTRWFXAbK2SbRBY73Clb5yzVQjJFmolEltdHM rghsU472KZIiWeoCNtgCAaYZBbKO5k6tKiW0/OSTz9TPoTB+Xd/5OwQO8HftdTlQwuZG kL7/K3IKg6r3n145O+zTpknPcWKG71fAfdMjhPm0R0XZ3EOEotBhlQQY4BanG3HXwx0v Vk99TGJKqaeaWR7Iv/+rVjYaDBqjVzBvr/aXme5R6BRkHi/aI0wgKDwR8EDWZUBVak4F MhBuRN3wXvcHC8o//TRN/XeqtvnQPxJjpf3OjsW2O8Y8rQNrKwbkWBRACw2Blz5xCcW8 kv8A== X-Forwarded-Encrypted: i=1; AJvYcCX3LSFR8I3meinILCjuidIbDyc/Wl8l7J2rRUBU5Gf4SLvbLA/YekOmAgsv0R0QVtcyEXvCyfcIqSXn8Ue/F9o=@vger.kernel.org X-Gm-Message-State: AOJu0YzSWpWSuPX+wrmMfIYe9SGnDgrrf4mJ8otW7lAab/pnZhNxNBmT TZjW2yYVoXmxSQKZNQQUUFHAaL+vu7PCcHy/RUnj3JzwPDwQeubt/VqN X-Gm-Gg: ASbGncuds3J8b/NPhy7TfzE4y2X5obGWYUCixQ9o17DH2Msr1kJjcRGR6aN9Rtypjf1 kta1o6PkVaMgLUHHmZsYNGyUSSFZayul60uuhdud+TXOlH7xBNffnN+Z+BvWCfA7PNiU3i3uZ/H AFoobtiNC3EpVHLQRYcE241pCQ6KWxL59hCMK9HyyOAHQkBAgAb/83GiWskJzJbTDk5qgFlTAyN 8R7kTAt7iBSoUHnvmsa6ZS4oK1K4zEO/+LmXXeP+EMqa8Jjgha2WO5BUY5GEVUerZtWNJUaGVGN xLf2zgJJB3mxdDxjG8XA6h3o19AU1Yc9d5KDO4yPUs8cynT66mjKXGkWheITUrglwzNV7vab8Q0 fgEpMf6t/xMUxwT+w56N8CAu7YDoQYjxT+fPTQHT2Dg1RaF+Bz/kkeG/YaJmPTL6l/0QcRijAqY NCpacoDfUVSiWaRY2WTIcQ3vLrh4Y02gfItX9E7PpoNPR15RenPaTY X-Google-Smtp-Source: AGHT+IF0GP+pqaKG4PhgW/HWMVcgie4ld9+aoLno5OGZiyBWMEqef3f9IS+F+vZ3lhE/VUXuRC3tJA== X-Received: by 2002:a05:6000:2c0b:b0:429:d0b8:3850 with SMTP id ffacd0b85a97d-42cc1d0cd26mr39852844f8f.48.1764625182679; Mon, 01 Dec 2025 13:39:42 -0800 (PST) Received: from pumpkin (82-69-66-36.dsl.in-addr.zen.co.uk. [82.69.66.36]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-42e1caae37esm28492546f8f.40.2025.12.01.13.39.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Dec 2025 13:39:42 -0800 (PST) Date: Mon, 1 Dec 2025 21:39:38 +0000 From: David Laight To: "Eric W. Biederman" Cc: Roberto Sassu , Bernd Edlinger , Alexander Viro , Alexey Dobriyan , Oleg Nesterov , Kees Cook , Andy Lutomirski , Will Drewry , Christian Brauner , Andrew Morton , Michal Hocko , Serge Hallyn , James Morris , Randy Dunlap , Suren Baghdasaryan , Yafang Shao , Helge Deller , Adrian Reber , Thomas Gleixner , Jens Axboe , Alexei Starovoitov , "linux-fsdevel@vger.kernel.org" , "linux-kernel@vger.kernel.org" , linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, tiozhang , Luis Chamberlain , "Paulo Alcantara (SUSE)" , Sergey Senozhatsky , Frederic Weisbecker , YueHaibing , Paul Moore , Aleksa Sarai , Stefan Roesch , Chao Yu , xu xin , Jeff Layton , Jan Kara , David Hildenbrand , Dave Chinner , Shuah Khan , Elena Reshetova , David Windsor , Mateusz Guzik , Ard Biesheuvel , "Joel Fernandes (Google)" , "Matthew Wilcox (Oracle)" , Hans Liljestrand , Penglei Jiang , Lorenzo Stoakes , Adrian Ratiu , Ingo Molnar , "Peter Zijlstra (Intel)" , Cyrill Gorcunov , Eric Dumazet , zohar@linux.ibm.com, linux-integrity@vger.kernel.org, Ryan Lee , apparmor Subject: Re: Are setuid shell scripts safe? (Implied by security_bprm_creds_for_exec) Message-ID: <20251201213938.184d71db@pumpkin> In-Reply-To: <87ms42rq3t.fsf@email.froward.int.ebiederm.org> References: <87tsyozqdu.fsf@email.froward.int.ebiederm.org> <87wm3ky5n9.fsf@email.froward.int.ebiederm.org> <87h5uoxw06.fsf_-_@email.froward.int.ebiederm.org> <6dc556a0a93c18fffec71322bf97441c74b3134e.camel@huaweicloud.com> <87v7iqtcev.fsf_-_@email.froward.int.ebiederm.org> <87ms42rq3t.fsf@email.froward.int.ebiederm.org> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf) Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Mon, 01 Dec 2025 12:53:10 -0600 "Eric W. Biederman" wrote: > Roberto Sassu writes: ... > There is the partial solution of passing /dev/fd instead of passing the > name of the script. I suspect that would break things. I don't > remember why that was never adopted. I thought that was what was done - and stopped the problem of a user flipping a symlink between a suid script and one the user had written. It has only ever been done for suid scripts when the uid actually changes. Which makes it possible to set the permissions so that owner can't run the script! (The kernel only needs 'x' access, the shell needs 'r' access, so with 'x+s' the owner can't execute the script but everyone else can.) There is a much older problem that probably only affected the original 1970s 'sh' (not even the SVSV/Sunos version) that quoted redirects on the command line would get actioned when the parameter was substituted - which I think means the original 'sh' did post-substitution syntax analysis (the same as cmd.exe still does). That doesn't affect any shells used since the early 1980s. David