Date: Tue, 18 Jan 2011 14:42:26 GMT From: Ihor R <kaba@goodnet.com.ua> To: freebsd-gnats-submit@FreeBSD.org Subject: amd64/154112: user can delete file witch owned by root:wheel Message-ID: <201101181442.p0IEgQD8009292@red.freebsd.org> Resent-Message-ID: <201101181450.p0IEo3rD068619@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 154112 >Category: amd64 >Synopsis: user can delete file witch owned by root:wheel >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-amd64 >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Jan 18 14:50:03 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Ihor R >Release: 7.3, 8.0, 8.1 >Organization: GoodNet Ukraine >Environment: FreeBSD bravo.goodnet.com.ua 8.0-RELEASE-p4 FreeBSD 8.0-RELEASE-p4 #0: Fri Aug 27 15:53:40 EEST 2010 root@bravo.goodnet.com.ua:/usr/obj/usr/src/sys/BRAVO amd64 FreeBSD zorro.goodnet.com.ua 7.3-RELEASE-p2 FreeBSD 7.3-RELEASE-p2 #0: Sat Jul 31 13:54:09 EEST 2010 root@zorro.goodnet.com.ua:/usr/obj/usr/src/sys/PAE-DA i386 FreeBSD sm5.bitte-hosting.com 8.1-RELEASE-p2 FreeBSD 8.1-RELEASE-p2 #0: Fri Jan 14 20:30:40 UTC 2011 Denis@sm5.bitte-hosting.com:/usr/obj/usr/src/sys/KERN-14-01-2011 amd64 >Description: The broblem is: user can delete files in own home directory owned by root:wheel. >How-To-Repeat: as root, change current directory to user home : #cd ~username/ #touch 1.txt #chown root:wheel 1.txt login to system as user: %id uid=1001(username) gid=1001(username) groups=1001(username) %ls -la | grep 1.txt -rw-r--r-- 1 root wheel 0 Jan 18 16:38 1.txt %rm -f 1.txt %ls -la | grep 1.txt % >Fix: >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201101181442.p0IEgQD8009292>