Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 11 Jul 2005 09:35:06 +0400
From:      Igor Robul <igorr@speechpro.com>
To:        Daniel Auman <dauman@pcsinconline.com>
Cc:        freebsd-questions@freebsd.org
Subject:   Re: Logging into FreeBSD
Message-ID:  <42D2050A.2060903@speechpro.com>
In-Reply-To: <000201c58404$ec17de50$0500000a@LAPTOP>
References:  <000201c58404$ec17de50$0500000a@LAPTOP>

next in thread | previous in thread | raw e-mail | index | archive | help
Daniel Auman wrote:

>Thank you!!! I would have not known about that key combination!
>
>  
>
You just need know, that most Unix interractive tools have such command. 
If you wish give user very restricted environment, then you can write 
simple C program which will chroot user into restricted directory, 
change user id and exec mysql command line client. Then you can make 
this program setuid root (tripple check your program) and make it user 
shell (man chsh).

But better, dont give shell to this untrusted user, and just use some 
WWW frontend for mysql.

>>#!/bin/sh
>>
>>mysql -u "username" -p"password"
>> 
>>
>>    
>>
>User just can do "\! /bin/sh" at mysql prompt and get shell access.
>
>
>
>
>  
>




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?42D2050A.2060903>