[5422] in RedHat Linux List
RE: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Erik Troan)
Thu Nov 21 11:08:40 1996
Date: Thu, 21 Nov 1996 11:05:58 -0500 (EST)
From: Erik Troan <ewt@redhat.com>
To: "'redhat-list@redhat.com'" <redhat-list@redhat.com>
In-Reply-To: <01BBD791.6F676F20@dhlaptop.cr.mci.com>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
On Thu, 21 Nov 1996, Dwight Hubbard wrote:
> Could you summarize why each one is set uid??
<sigh> I don't know why I'm doing this.
Note that the X servers are not in this list, though they are all suid root.
-rwsr-xr-x- root root 12268 Oct 28 17:29 /bin/ping
Needs to open a raw socket.
-rwsr-xr-x- root root 13708 Oct 28 17:29 /usr/bin/rcp
-rwsr-xr-x- root root 9572 Oct 28 17:29 /usr/bin/rlogin
-rwsr-xr-x- root root 6740 Oct 28 17:29 /usr/bin/rsh
Protocol requires client request to come from a privledge port.
-rwsr-xr-x- root root 13076 Sep 01 11:21 /usr/X11R6/bin/xload
<blush> This doesn't need to be xload on Linux (it does on machines w/o our
wonderful /proc fs) -- I'll get this fixed.
-rwsr-xr-x- root root 17412 Oct 23 1995 /usr/lib/games/abuse/keydrv
Uses SVGAlib (abuse will not be in the next release of Red Hat btw, as it
doesn't work with recent kernels).
-rwsr-xr-x- root daemon 17732 Aug 09 11:32 /usr/bin/at
Writes to /var/spool/at when you submit jobs.
-rwsr-xr-x- root root 300036 Aug 30 13:02 /usr/games/sdoom
SVGAlib.
-rwsr-xr-x- root root 572612 Sep 09 11:27 /usr/bin/dos
vm86() call [this will only allow root and users in /etc/dosusers to run
it though].
-rwsr-sr-x- root tty 51296 Aug 29 16:30 /sbin/dump
-rwsr-sr-x- root tty 55376 Aug 29 16:30 /sbin/restore
Uses rsh internally for remote dump/restore.
-r-sr-xr-x- root root 5332 Sep 09 19:39 /usr/sbin/inndstart
I don't know about this one (comments folks??).
-rwsr-xr-x- root root 504000 Sep 02 11:57 /usr/games/koules.svga
-rws--x--x- root root 14680 Sep 02 11:28 /usr/games/vga_klondike
-rws--x--x- root root 15260 Sep 02 11:28 /usr/games/vga_ohhell
-rws--x--x- root root 12660 Sep 02 11:28 /usr/games/vga_solitaire
-rws--x--x- root root 16116 Sep 02 11:28 /usr/games/vga_spider
-rws--x--x- root root 17880 Sep 02 11:28 /usr/games/vga_connectN
-rws--x--x- root root 15448 Sep 02 11:28 /usr/games/vga_mines
-rws--x--x- root root 18028 Sep 02 11:28 /usr/games/vga_othello
-r-s--x--x- root root 61240 Sep 02 11:30 /usr/games/tetris
-rws--x--x- root root 159472 Nov 20 17:27 /usr/X11R6/bin/kterm
-r-s--x--x- root root 88272 Sep 02 11:48 /usr/bin/zgv
SVGAlib
-r-sr-sr-x- root lp 13404 Oct 25 13:10 /usr/bin/lpq
-r-sr-sr-x- root lp 14508 Oct 25 13:10 /usr/bin/lpr
-r-sr-sr-x- root lp 14164 Oct 25 13:10 /usr/bin/lprm
Secure port and access to /var/spool/lpd
-rwsr-xr-x- root root 74628 Oct 27 09:01 /usr/lib/mc/bin/cons.saver
Good question. I'm asking about this one.
-rwsr-sr-x- root mail 72628 Oct 17 17:57 /usr/bin/mh/inc
-rwsr-xr-x- root root 52536 Oct 17 17:57 /usr/bin/mh/msgchk
Access /var/spool/mail
-rwsr-xr-x- root root 29712 Aug 30 15:01 /bin/mount
-rwsr-xr-x- root root 16360 Aug 30 15:01 /bin/umount
For "user" mount attribute.
-r-sr-xr-x- root bin 19031 Aug 26 14:29 /usr/bin/passwd
Accesses /etc/passwd or /etc/shadow.
-rwsr-xr-x- root root 8356 Oct 22 14:49 /sbin/cardctl
Allows any user to look at pcmcia configuration (only root is allowed to
modify it -- I'm not sure this is a good idea but it is what the author
recommends).
-rws--x--x- root root 435676 Oct 29 15:28 /usr/bin/sperl5.003
-rws--x--x- root root 435676 Oct 29 15:28 /usr/bin/suidperl
Runs SUID perl scripts.
-rwsr-sr-x- root mail 54384 Aug 11 23:14 /usr/bin/procmail
Accesses /var/spool/mail
-r-sr-xr-x- root root 10412 Aug 14 11:35 /usr/X11R6/bin/XConsole
Reads /dev/console
-rwsr-xr-x- root root 52244 Nov 20 17:05 /usr/X11R6/bin/rxvt
-rwsr-xr-x- root root 264036 Oct 24 14:57 /usr/bin/screen
-rws--x--x- root root 136504 Nov 20 15:04 /usr/X11R6/bin/nxterm
(add xterm to this list [we don't have the XFree packages in devel right now)
Updates utmp/wtmp.
-rwsr-sr-x- root mail 281748 Nov 18 09:45 /usr/sbin/sendmail
/var/spool/mail
-rwsr-xr-x- root root 12208 Oct 15 15:59 /bin/su
setuid()
---s--x--x- root root 9012 Aug 26 18:40 /usr/sbin/traceroute
Same as ping
-rwsr-xr-x- root root 19300 Oct 25 11:18 /bin/login
Any user is allowed to run login to change login sessions (this is traditional,
though dumb)
-rwsr-xr-x- root root 10080 Oct 25 11:18 /usr/bin/chfn
-rwsr-xr-x- root root 9612 Oct 25 11:18 /usr/bin/chsh
Edit /etc/passwd
-rwsr-xr-x- root root 3852 Oct 25 11:18 /usr/bin/newgrp
Changes active group.
-rwsr-xr-x- root root 20036 Nov 20 16:54 /usr/bin/crontab
Edits cron files, signals cron.
Whew ;-)
Erik
-------------------------------------------------------------------------------
| I told you I'm not very bright -- Sugar in "Some Like It Hot" |
| |
| Erik Troan = http://sunsite.unc.edu/ewt/ = ewt@sunsite.unc.edu |
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
