From owner-freebsd-hackers Fri Aug 16 09:26:46 1996 Return-Path: owner-hackers Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id JAA26754 for hackers-outgoing; Fri, 16 Aug 1996 09:26:46 -0700 (PDT) Received: from brasil.moneng.mei.com (brasil.moneng.mei.com [151.186.109.160]) by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id JAA26746 for ; Fri, 16 Aug 1996 09:26:42 -0700 (PDT) Received: (from jgreco@localhost) by brasil.moneng.mei.com (8.7.Beta.1/8.7.Beta.1) id LAA15564; Fri, 16 Aug 1996 11:25:21 -0500 From: Joe Greco Message-Id: <199608161625.LAA15564@brasil.moneng.mei.com> Subject: Re: Routed supports variable-length netmasks? To: mnewell@kaizen.net (Mike Newell) Date: Fri, 16 Aug 1996 11:25:21 -0500 (CDT) Cc: nate@mt.sri.com, jgreco@brasil.moneng.mei.com, hackers@freefall.freebsd.org In-Reply-To: from "Mike Newell" at Aug 16, 96 11:43:53 am X-Mailer: ELM [version 2.4 PL24] Content-Type: text Sender: owner-hackers@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk > On Fri, 16 Aug 1996, Nate Williams wrote: > > > /etc/ppp/ip-up and /etc/ppp/ip-down are run as root, no matter who the > > login user is. This also means you must be careful what you put in > > there, but since the environment is safeguarded pretty well it would be > > hard to break into a system via them. > > Well, in my case they didn't work. So I added lines of the form: > > route add ...... >> /var/log/ip-up.log 2>&1 > > and found routed was complaining that routes can only be changed by root. > Reading the man page for pppd is specifically says: > > /etc/ppp/ip-up > > ... snip ... > > This program or script is executed with the same > real and effective user-ID as pppd, that is, at > least the effective user-ID and possibly the real > user-ID will be root. This is so that it can be > used to manipulate routes, run privileged daemons > (e.g. sendmail), etc. Be careful that the con- > tents of the /etc/ppp/ip-up and /etc/ppp/ip-down > scripts do not compromise your system's security. > > > I'm not clear on how to interpret this, but apparently the _real_ UID is > root, but the _effective_ UID is that of the account used to invoke pppd. > Route appears to check the effective UID, so it refuses to do its thing. > Setting the script SUID has no effect. Neither does adding the ppp login > account to the "wheel" group. :-( > > As a workaround I log into our box as root [ugh!] to invoke pppd, but > clearly that's not the answer. I'm running 2.1-RELEASE; maybe things > changed in 2.1.5? Yeah yeah that's the ticket. Verrrry familiar problem. I believe I hacked a copy of route to fix this problem and installed it as /etc/ppp/route... ... JG