setuid programs

Top Page
Attachments:
Message as email
+ (text/plain)
Delete this message
Reply to this message
Author: Bill Warner
Date:  
Subject: setuid programs
On 15 Jan 2001 05:05:37 +0000, Jason wrote:
> wrote:
> >
> > 1. Try "chmod 500 /bin/ps".
> >
> > 2. grep all source code for "not secure for set uid operation".
> >    Modify the source code to disable this "feature."
> >    Compile.

>
> hell, greping the relevant binarys for that string might even be a
> good idea... why would one be using iBCS and a SCO binary if one could
> recompile?


ps is the native linux version, there is a custom sco binary used in
our application called
pm. this program basicly uses ps to get username and pid for a user
within our bussiness
application. I don't like it but pm is set uid and when called it gives
the program not secure
to run as setuid. this message is comming seems to be comming from ps.
I am guessing
that a recomplie of ps is going to be needed.


>
> -- 
> jkenner @ mindspring . com__
> I Support Linux:           _> _  _ |_  _  _     _|
> Working Together To       <__(_||_)| )| `(_|(_)(_|
> To Build A Better Future.       |                   <s>

>
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post to the list quickly and you use Netscape to write mail.
>
> Plug-discuss mailing list -
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss




--
--
Bill Warner
Direct Alliance Corp.
Unix/Linux Admin.