Date: Thu, 12 Jul 2018 20:57:07 +0200 From: "Julian H. Stacey" <jhs@berklix.com> To: Guy Helmer <guy.helmer@gmail.com> Cc: Diane Bruce <db@db.net> Subject: Re: How to add su to /rescue ? Message-ID: <201807121857.w6CIv7TX089208@fire.js.berklix.net> In-Reply-To: Your message "Mon, 09 Jul 2018 14:13:40 -0500." <2ACD0DE9-3C43-48DE-BD5A-E074E1A4740E@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Guy Helmer wrote: > > On Jul 9, 2018, at 6:54 AM, Julian H. Stacey <jhs@berklix.com> wrote: > > Hi current@ > > I want to add su to /rescue, but got stuck on pam. > > Old unix su didn't suffer from pam. > > There's no #define in su to turn off pam. > > Man src.conf says WITHOUT_PAM is deprecated & does nothing. > > > > Can someone please offer a solution ? > > Or better to include a simple BSD su pre pam ? > > I would happily develop a patch for that. > Hi, > Aside from not being able to use pam from a static executable, please don’t try to make the crunched hard-linked executable in /rescue setuid-root (su is useless without it). That would mean anyone running /rescue/sh gets a root shell :-) Thanks Guy ! Yes all SUID 0 would be very wrong. > Conceptually, a separate crunchgen binary could be made for setuid-root purposes, but having a setuid-root binary in /rescue (outside of the normal hierarchy) makes me nervous. In case other suid things are also needed later, I created a local src/rescue/suid/ with an old su.c pre PAM, Thanks to Diane Bruce, & a diff & Makefile to drive it. http://berklix.com/~jhs/src/bsd/fixes/freebsd/src/gen/rescue/ It works, but improvements welcome. Cheers, Julian -- Julian Stacey, Computer Consultant, Systems Engineer, BSD Linux Unix, Munich Brexit Referendum stole 3.7 million votes inc. 700,000 from British in EU. UK Goverment lies it's democratic in Article 50 paragraph 3 of letter to EU. http://exitbrexit.uk
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201807121857.w6CIv7TX089208>