Date: Tue, 17 Nov 1998 18:45:47 -0600 From: William McVey <wam@sa.fedex.com> To: Mikael Karpberg <karpen@ocean.campus.luth.se> Cc: dillon@apollo.backplane.com (Matthew Dillon), hackers@FreeBSD.ORG, freebsd-security@FreeBSD.ORG Subject: Re: Would this make FreeBSD more secure? Message-ID: <199811180046.SAA23057@s07.sa.fedex.com>
next in thread | raw e-mail | index | archive | help
Mikael Karpberg wrote: >Yes, check_pw can just as well be setgid shadow. The point is, check_pw >would be very small (well under 100 lines, I'd guess), Agreed. >and should then be possible to make secure enough to run as setuid root. Even if the program is made "secure", I still think it would be assigned an excess of privilege if made setuid root. Again, I'm trying to stay focused on the original suggestion of a new group with read access to the password files and the proposed changes to the getpwent code to base access to the shadowed passwords on file permissions rather than "am I root or not root". >And what's wrong with popen() even if I was? popen (at least historically) passes down environment variables (such as IFS and LD_LIBRARY_PATH) which can cause a program popen()ed by a setuid program (or setgid program for that matter) to run code the author perhaps didn't expect. >Again... I didn't write that piece of code as a suggested code, but more >like a well-written pseudo-code. I think this might have been a mistake. >I should have used less correct c-code. I replied pointing out the bug simply to show that even simple (and apparently correct) programs can have mistakes in them, and to demonstrate what I've been trying to convince people of. A new group for programs like xlock or check_pw to be setgid to would be better than requiring these programs to be setuid root. I'm somewhat new on the security list. What does it take to get changes decided on? Does something like this need 'general consensus and running code' (ala IETF), is something like this voted on, or does someone just go out and do it once they get convinced? >I think you missunderstood something seriously. The process will SEGV >no matter if it's run by root. Root is just like any user, until he >does a system call that requires authentication. Yup. I was mistaken about the scribbling in memory without SEGVing. -- William To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199811180046.SAA23057>