s*******l
发帖数: 8 | 1 I have a perl program which will create a file. I set the setuid permission
for the perl program, say: chmod 6755 myperl.pl
Then, when I execute it as other users, either the created file is owned by
another user (say, root), or an error happened and the program can not be
run by others:
Insecure ENV{$PATH} ....
How to deal with this? Thanks a lot. |
|
p******f
发帖数: 162 | 2
you are adviced to explicitly set the $PATH env var in a setuid perl
program, read 'man perlsec' for details. |
|
p******f
发帖数: 162 | 3 the owner of the perl executable, if setuid.
the person who runs the executable, otherwies. |
|
m**********e
发帖数: 12525 | 4 使用Vista 2个月后的感觉,Vista正在步当年UNIX犯下的SetUID老路.
比如Vista下IE7打开"个性化收藏夹菜单(Personalized Favorites Menu)"
后无法工作,必须关掉UAC,或者关掉IE7 protected mode,或者把IE7 setuid
成Administrator才能正常工作.
许多XP下的软件都无法保存设置文件,因为保存文件这个功能在Vista下需要
SetUID才能实现.感觉现在的Vista简直是10年前UNIX的一个翻版.
发信给microsoft,回答说we confirm your research.这些问题将在今年年底
出版的Vista SP1内解决. |
|
m**********e
发帖数: 12525 | 5 【 以下文字转载自 Hardware 讨论区 】
发信人: mifepristone (弃婴), 信区: Hardware
标 题: 感觉Vista的文件系统有严重安全问题
发信站: BBS 未名空间站 (Fri Jul 20 17:56:37 2007)
使用Vista 2个月后的感觉,Vista正在步当年UNIX犯下的SetUID老路.
比如Vista下IE7打开"个性化收藏夹菜单(Personalized Favorites Menu)"
后无法工作,必须关掉UAC,或者关掉IE7 protected mode,或者把IE7 setuid
成Administrator才能正常工作.
许多XP下的软件都无法保存设置文件,因为保存文件这个功能在Vista下需要
SetUID才能实现.感觉现在的Vista简直是10年前UNIX的一个翻版.
发信给microsoft,回答说we confirm your research.这些问题将在今年年底
出版的Vista SP1内解决. |
|
o***s
发帖数: 31 | 6 It depends on if you run perl script under CGI web environment. For apache
you may set User and Group entry in apache.conf/httpd.conf to force the user
and group.
For running perl under console commandline, if unix/linux, you need to
setuid the SAS program, change permisstion to 4555. if SAS program is a
script instead of binary executable, you'll have to write a C wrapper to
call it and setuid on this C wrapper program, then have your perl call your
C program. |
|
m**********e
发帖数: 12525 | 7 这是vista文件系统的安全漏洞,跟当年unix的setuid一个毛病
解决方案: 把你的flashget setuid成administrator |
|
f*******5
发帖数: 10321 | 8 争得是怎么看待setuid。:)
也举一个例子，某客户跟我们说，你们的CSO能不能给我们背书一下android是安全的，
这样我们也能用android设备（注，我们既不推广android，也不卖android设备和服务
）。你要是问他们担心哪个方面，他们也不知道。android肯定有安全弱点，不过要说
android不安全还是得在正确的context下从正确的angle来说。
root |
|
|
n****1
发帖数: 1136 | 9 su不需要confirmation, 所有程序默认uid=0. sudo则是每次运行都需要confirm, 临时
通过setuid来改权限。
你确定你真懂android root原理？随便找个root过后的手机运行下"ps aux",把结果发上
来,看看是否所有程序都是root身份运行？
觉得你才是那个对root一知半解的人。 |
|
m**h
发帖数: 69 | 10 Usually listening on TCP ports below 1024 are accessible by root only.
You may choose higher ports for APACHE, or use setuid.
password?
I'd try to define a new cgi service calling awk |
|
Z****e
发帖数: 2999 | 11 This is what I tried:
first, need setuid on screen:
sudo chmod +s /usr/bin/screen
sudo chmod 755 /var/run/screen
on test1 account, this is the .screenrc:
multiuser on
addacl test2
then with test2 account, do:
$ screen -S test1/[PID] -r |
|
D*******a
发帖数: 3688 | 12 I used to have a setuid-ed bash in my home folder...
but sudo is safer, admittedly |
|
|
|
m**k
发帖数: 290 | 15 netapp has setuid setgid flags? |
|
m*****e
发帖数: 4193 | 16
Then your system must have a weird (or dangerous/incorrect) setting
which allows normal users to use raw socket, assuming your nmap is
not setuid root (since you claim you are not a new comer in OS).
Oh I was confused by your question. I would have appreciated it if
you had made clear what "cannot read socket" means.
This makes me more confused. |
|
p****s
发帖数: 3184 | 17
Yes, he has many ways to put a Trojan horse under your account,
for example, a setuid program hidden somewhere in your file system. |
|
z**********u
发帖数: 23 | 18 Dear all,
Thank you very, very much!
I checked what are under my home directory and found nothing unusual. Can the
trojan be hidden in some other directories that don't belong to me? BTW, I
don't know how to check for setuid programs.
I really appreciate your help. My friend is a known hacker. I shouldn't have
let him use my Unix account 2 years ago. The police is going to question me
next week.
【 在 pjones (彼得) 的大作中提到: 】
要完
应，
使我 |
|
m****n
发帖数: 5 | 19 HI, all
my system is Sun Solaris 8, my /usr directory is mounted to be a read-only
file system, how to change it to a read/write file system?
bash-2.03$ mount
/usr on /dev/md/dsk/d2 read
only/setuid/intr/largefiles/onerror=panic/dev=154000
2 on Wed Aug 21 18:13:42 2002
Thanks a lot |
|
s*******l
发帖数: 8 | 20 What if the perl tries to install some program? Who will be the owner?
Thanks a lot. |
|
o***z
发帖数: 133 | 21 save the effective uid at the beginning by $euid=$EUID (if you use English)
then set it back to the real UID by saying $EUID=$UID
switch back to enhanced permission by $EUID=$euid only when necessary
and reduce to normal permission as early as possible |
|
r*****d
发帖数: 54 | 22 what does your "process" mean?
user can use setuid to run the program as another user such as root but must
get permission from root, I mean if you run a program owned by the root,
your program can let you behave like a root |
|
m*****e
发帖数: 4193 | 23 Maybe just your system is broken.
dc is not setuid root so it cannot work. |
|
s*****a
发帖数: 1022 | 24 最后发现sharity还是得root装了才能mount, 原来linux下的smbmnt是setuid root的
怪不得谁都可以smbmount |
|
m**********e
发帖数: 12525 | 25 【 以下文字转载自 Chicago 讨论区,原文如下 】
发信人: mifepristone (弃婴), 信区: Chicago
标 题: Re: [转载] a UNIX permission question
发信站: Unknown Space - 未名空间 (Tue Jan 25 13:41:53 2005) WWW-POST
unix chmod的两大trick之一，第一个就是这个你说的 “chmod + t”
正式名称是“save program *text* on swap device”，早年计算机
内存不大的时候用的，用于文件，就是文件放到swap device,用于目录，
就是不能删只能写。
chmod的第二大trick就是“chmod + s”，或者叫“set userID”，就是
让其他人有操作你这个文件的权力。
setuid这个东西知道的人比较多，因为这是黑客的最爱。
哈哈。这两招，是甄别unix高低手的准绳
files?
also |
|
