The Unix Heritage Society mailing list
 help / color / mirror / Atom feed
From: jason-tuhs@shalott.net
To: tuhs@tuhs.org
Subject: Re: [TUHS] Set-uid shell scripts
Date: Tue, 6 Aug 2019 01:28:43 -0700 (PDT)	[thread overview]
Message-ID: <alpine.LRH.2.21.1908060104130.2617@waffle.shalott.net> (raw)
In-Reply-To: <1564954057.6926.for-standards-violators@oclsc.org>


> A related problem is the inherent race condition:
> If you do
> 	ln -s /bin/setuidscript .
> 	./setuidscript
> ./setuidscript is opened twice: once when the kernel
> reads it and finds #! as magic number and execs the
> interpreter, a second time when the interpreter opens
> ./setuidscript.  If you meanwhile run something that
> swoops in in the background and replaces ./setuidscript
> with malicious instructions for the interpreter, you
> win.

This was always described to me as the canonical reason why setuid 
interpreted scripts were a security hole, irrespective of any specifics 
in the shell or other interpreter.

However, there's a workaround: use fdescfs.  fdescfs allows the kernel to 
open the script, and then pass the fdescfs path for the (already open) 
descriptor to the interpreter as the command to run.

According to https://www.in-ulm.de/~mascheck/various/shebang/#setuid, this 
is supported by many systems, including Solaris, several BSDs, and OSX 
(with a sysctl).


  -Jason


  reply	other threads:[~2019-08-06  8:36 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-04 21:27 Norman Wilson
2019-08-06  8:28 ` jason-tuhs [this message]
2019-08-06  9:55   ` arnold
2019-08-06 22:48   ` Dave Horsfall
2019-08-06 22:56     ` ron minnich
2019-08-07  1:21     ` Dave Horsfall
     [not found]       ` <40c92e85142fe7e3@orthanc.ca>
2019-08-07 21:33         ` Dave Horsfall
2019-08-08  6:39           ` Peter Jeremy
2019-08-07 12:56     ` Chet Ramey
2019-08-07 21:40       ` Dave Horsfall
2019-08-08  5:16         ` Adam Thornton
2019-08-14  5:41           ` Efton Collins
  -- strict thread matches above, loose matches on Subject: below --
2019-08-05  0:13 Noel Chiappa
2019-08-04 21:18 Norman Wilson
2019-08-04 20:18 Noel Chiappa
2019-08-04 20:29 ` Clem Cole
2019-08-04 20:42   ` Richard Salz
2019-08-04 23:58 ` Dave Horsfall
2019-08-04  7:36 Dave Horsfall
2019-08-04  7:43 ` Alec Muffett
2019-08-04 15:58   ` Noel Chiappa
2019-08-04 16:30     ` Michael Kjörling
2019-08-04 16:48       ` Alec Muffett
2019-08-04 17:48         ` Michael Kjörling
2019-08-04 19:45           ` Alec Muffett
2019-08-04 16:50     ` Rico Pajarola
2019-08-04  7:46 ` arnold

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.LRH.2.21.1908060104130.2617@waffle.shalott.net \
    --to=jason-tuhs@shalott.net \
    --cc=tuhs@tuhs.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).