From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3DC02773EE for ; Mon, 1 Dec 2025 21:39:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764625186; cv=none; b=uA3JrPTRRjnep+JiAkZOityKLuwz39weggKyFPwcLpwYX2jLgBrmxyyEHVfPq32JneH+OuwEyfixs/L58KT0jaAMd7ckpS+25ecRyzT2Ukad4s+4DVVXdLvy1kNOgZ3Q5DdqIY1b5MFk3D28HWsK3RquDuqA+fQYAQOAPNmeZ70= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764625186; c=relaxed/simple; bh=/RkCgTE/4Sl75hR0rlbGxd11uecUwoBDhtpuhsWfVcA=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cgSzw7NSyhB5yyb61hnNnen727fhulTUdIsLuoeEl4cePtdTRHblbVLxZca47fujyvK+YfSuu7T5okj418mQ2ytJv93kKISqUEJZu11mpwXDBkDmWE1EhKHLDtePEg7nRi+jidYXDtmXdnvMZQqIpkhVwmnfOHQRmHv0MTK43ak= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Xgs+HtWy; arc=none smtp.client-ip=209.85.221.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Xgs+HtWy" Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-42b38de7940so2329884f8f.3 for ; Mon, 01 Dec 2025 13:39:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764625183; x=1765229983; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=uZmRqhdDnonRvflYIO2SfgDWhvVya0E7TMh9w4AtTjQ=; b=Xgs+HtWyK5MQ/jnUBr+KIXECHApj+OALgOKz5VtDzjPSEoR5FInlvgHiZtFUB3z1kK U4lUkEBt5mnvZLshW54S4+8YTzEZtZ6xV6iL6RlCQhyCKa9PUBMlbcaf5cBv3v6RMJ1s BFQZM+CZZH4u+O8+faUtrMkIZZLphrZfzjqqFvlOyCq7oRa3HEfnaZ/douzRMaStvpzp CVNlJUKb235ZbLDqxyhtbaloqGaEjUXjATUGSNNLSg9X7KtXzm8EgJszk0ucghsmrLGc ZqDG7pOo5kKkOtEeCb+B1CNyQKzGISircodxMAwfMv+8qB6Xhg+88+xdEq/Tr9C5cCeU ZUDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764625183; x=1765229983; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=uZmRqhdDnonRvflYIO2SfgDWhvVya0E7TMh9w4AtTjQ=; b=I1vs5KOAkDtCw7IgnDj4IBK92esrDvoGEMAh5ayvaW88b/o5qZ/OylPLxsCPUFQK6C kdLntnWamhQEqv5YFLN7+8k0+eatT+O6F3nUqbW8llojAZQTK/2xIUZ4ROAdTRek9/1X 9oM+yNvyHGHfOtCm7KUHV5kbKTpwhfzwYBv2zpEeaCr+e7LR/sBB2r5oqgolqnitBfgt 2l4ZSHJiC6heM/w7bETGaM0vIA9D/5CvWMyJs/f/VmP6xue6awnL2rcUXRtZ3hWmRsD0 Jqs6j8+S/FVkGlsSdsvIhO3WIrFZwpf8eHL0BxvNY1jDZEdLWUjB0nLFVhXG6OXBAngx NYoA== X-Forwarded-Encrypted: i=1; AJvYcCVtqJsMrwLLt5ZbXDDtCK6CzwlwP4U92nDLeczyuyDFWAOXx5Ol2rmb3HF+7EupYhz/lw59pdLKHXf3nhQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxH+tOqdRS3wQHZpP7+CJgF3N6mQkZx7zmIdqBWxmEySZbFK4JV MK/JzkYa/ETSnI3i5PVJAGnntW/Uh1BnAoFvE92goQVXavo7tZwzQbyC X-Gm-Gg: ASbGncs8P3UReFce/wMCaaTvK6tyXAZU6CPKygsDto0vPy8kubNz60Qpn7Gsdr43Iq1 l8VEZMK07Ckw+gXfm1q4Cs5yQO5hSEUvbrT1e48qeSSaoOzecxPhG9oOqr5ZhXaZ23TYMiHWZWQ qunvmhEuDErV0U0vEpyjJDpSDrPHUujVBYLeFnJ+t+2ZXAg14SOPAwvcyyxYQVRhw8ibOMIZg5l +Wqp0q0z52JKP3rHEnfkX4XpIHv55wnHgEnVJ/I3jOipFm4m9xeBVLGCtlZYCdWcf3hLp3D02Jn QQkd74fLGY+9wAD2Ebj6K6Fbnh+YagG8DyF7LBPUO7CHkweqii/Rzf27FvQ6zAGmSdjszgv0ZOL unFZnj8J2HQH3Geby7eKsnTQLio86vAtYfg4dweb9s2heCIBRhacHUJF0jmK/QaDCz4J86Rn5P1 /PqEvtvc2iflZqoIX+nQ4i8YzAZPz5QrjKU8QFoUQaETJsCb1dm+sY X-Google-Smtp-Source: AGHT+IF0GP+pqaKG4PhgW/HWMVcgie4ld9+aoLno5OGZiyBWMEqef3f9IS+F+vZ3lhE/VUXuRC3tJA== X-Received: by 2002:a05:6000:2c0b:b0:429:d0b8:3850 with SMTP id ffacd0b85a97d-42cc1d0cd26mr39852844f8f.48.1764625182679; Mon, 01 Dec 2025 13:39:42 -0800 (PST) Received: from pumpkin (82-69-66-36.dsl.in-addr.zen.co.uk. [82.69.66.36]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-42e1caae37esm28492546f8f.40.2025.12.01.13.39.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Dec 2025 13:39:42 -0800 (PST) Date: Mon, 1 Dec 2025 21:39:38 +0000 From: David Laight To: "Eric W. Biederman" Cc: Roberto Sassu , Bernd Edlinger , Alexander Viro , Alexey Dobriyan , Oleg Nesterov , Kees Cook , Andy Lutomirski , Will Drewry , Christian Brauner , Andrew Morton , Michal Hocko , Serge Hallyn , James Morris , Randy Dunlap , Suren Baghdasaryan , Yafang Shao , Helge Deller , Adrian Reber , Thomas Gleixner , Jens Axboe , Alexei Starovoitov , "linux-fsdevel@vger.kernel.org" , "linux-kernel@vger.kernel.org" , linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, tiozhang , Luis Chamberlain , "Paulo Alcantara (SUSE)" , Sergey Senozhatsky , Frederic Weisbecker , YueHaibing , Paul Moore , Aleksa Sarai , Stefan Roesch , Chao Yu , xu xin , Jeff Layton , Jan Kara , David Hildenbrand , Dave Chinner , Shuah Khan , Elena Reshetova , David Windsor , Mateusz Guzik , Ard Biesheuvel , "Joel Fernandes (Google)" , "Matthew Wilcox (Oracle)" , Hans Liljestrand , Penglei Jiang , Lorenzo Stoakes , Adrian Ratiu , Ingo Molnar , "Peter Zijlstra (Intel)" , Cyrill Gorcunov , Eric Dumazet , zohar@linux.ibm.com, linux-integrity@vger.kernel.org, Ryan Lee , apparmor Subject: Re: Are setuid shell scripts safe? (Implied by security_bprm_creds_for_exec) Message-ID: <20251201213938.184d71db@pumpkin> In-Reply-To: <87ms42rq3t.fsf@email.froward.int.ebiederm.org> References: <87tsyozqdu.fsf@email.froward.int.ebiederm.org> <87wm3ky5n9.fsf@email.froward.int.ebiederm.org> <87h5uoxw06.fsf_-_@email.froward.int.ebiederm.org> <6dc556a0a93c18fffec71322bf97441c74b3134e.camel@huaweicloud.com> <87v7iqtcev.fsf_-_@email.froward.int.ebiederm.org> <87ms42rq3t.fsf@email.froward.int.ebiederm.org> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Mon, 01 Dec 2025 12:53:10 -0600 "Eric W. Biederman" wrote: > Roberto Sassu writes: ... > There is the partial solution of passing /dev/fd instead of passing the > name of the script. I suspect that would break things. I don't > remember why that was never adopted. I thought that was what was done - and stopped the problem of a user flipping a symlink between a suid script and one the user had written. It has only ever been done for suid scripts when the uid actually changes. Which makes it possible to set the permissions so that owner can't run the script! (The kernel only needs 'x' access, the shell needs 'r' access, so with 'x+s' the owner can't execute the script but everyone else can.) There is a much older problem that probably only affected the original 1970s 'sh' (not even the SVSV/Sunos version) that quoted redirects on the command line would get actioned when the parameter was substituted - which I think means the original 'sh' did post-substitution syntax analysis (the same as cmd.exe still does). That doesn't affect any shells used since the early 1980s. David