[6065] in RedHat Linux List
Re: problems with /usr/X11/bin/SuperProbe being setuid
daemon@ATHENA.MIT.EDU (Steve \"Stevers!\" Coile)
Mon Nov 25 17:03:40 1996
Date: Mon, 25 Nov 1996 16:10:02 -0500 (EST)
From: "Steve \"Stevers!\" Coile" <scoile@patriot.net>
To: Borg <vladimip@iceonline.com>
cc: Red Hat Mailing List <redhat-list@redhat.com>
In-Reply-To: <3299DD47.2D9835D6@iceonline.com>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
On Mon, 25 Nov 1996, Borg wrote:
> Steve "Stevers!" Coile wrote:
> ..................
> > Actually, I believe it is the changing ownership of a file to root that
> > requires privileges, not setting the set user ID bit. I believe every
> > user can make an executable they own setuid (or setgid, for that matter).
> > Unless you're root, tar won't be able to change the ownership of files
> > unpacked from an archive to root, even if they were owned by root on
> > the system on which the archive was made. In other words, privileges
> > from other systems don't transfer.
>
> Yes they do when you use tar. So, a user takes SuperProbe
> binary, as root executes chmod u+s and chown root:root, tars
> it up and uploads it on a box where he has only user privileges,
> then untars and runs it.
I'd love to know how that works, since neither a non-root user nor tar
have the privileges necessary to change the ownership of file.
--
Steve Coile P a t r i o t N e t Systems Engineering
scoile@patriot.net Patriot Computer Group (703) 277-7737
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
