[44] in bugtraq
Re: chmod 000 .rhosts - works?
daemon@ATHENA.MIT.EDU (John Abreau)
Wed Oct 19 04:45:09 1994
Date: Wed, 19 Oct 1994 02:06:55 +0100
From: John Abreau <jabr@bcs.org>
To: Peter Wemm <peter@haywire.DIALix.COM>
Cc: Charles Howes <chowes@helix.net>, cellwood@gauss.ELEE.CalPoly.EDU,
jseng@darwin.technet.sg, nlawson@galaxy.csc.calpoly.edu,
bugtraq@fc.net
In-Reply-To: <199410171549.XAA21975@haywire.DIALix.COM>
On Mon, 17 Oct 1994, Peter Wemm wrote:
>
> Better still are the versions of expreserve that do a
> system("mkdir ....");
> Create a file called "mkdir" and put "." in your path.
>
> Just out of interest, what is needed to make it safe? Is making it
> non-setuid/setgid and /usr/preserve mode 1777 sufficient?
>
I'd think the most straightforward fix would be to replace the uses of
system(...) in the source. In the example above, replace
system("mkdir foo");
with
mkdir("foo", 0700);
(This assumes, of course, that you have sources...)
--
John Abreau / Director, BCS Linux/Unix Group / jabr@bcs.org
The Boston Computer Society / 101 First Avenue, Suite 2 / Waltham, MA 02154
Voice +1 617 290 5700 / Fax +1 617 290 5744
