Re: hard links create local DoS vulnerability and security proble

Valdis.Kletnieks
2003-11-24T20:00:35Z

[-- Attachment #1: Type: text/plain, Size: 676 bytes --]

On Mon, 24 Nov 2003 14:25:31 EST, Mathieu Chouquet-Stringer said:

> It's always been my understanding that you cannot have suid shell script
> because you could easily change the IFS. Am i wrong? (

IFS is just one of the *many* issues (there's also a ton of race conditions
caused by #! handling, among other things).

You don't like the shell script, feel free to substitude in the C-language
equivalent that was posted previously :)

(And yes, I did it intentionally - figuring that at least one user on the
list would actually do it and leave a set-UID something lying around to
shoot themselves in the foot with, so weaponry loaded with blanks seemed a
good idea... ;)

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]