[3593] in bugtraq
Re: HP-UX setprivgrp()
daemon@ATHENA.MIT.EDU (Dominique Quatravaux)
Thu Nov 7 18:55:50 1996
Date: Thu, 7 Nov 1996 22:51:54 +0100
Reply-To: Dominique Quatravaux <quatrava@clipper.ens.fr>
From: Dominique Quatravaux <quatrava@clipper.ens.fr>
To: Multiple recipients of list BUGTRAQ <BUGTRAQ@NETSPACE.ORG>
In-Reply-To: Mail from '"Eduardo E. Silva" <esilva@netcom.com>' dated: Thu, 7
Nov 1996 11:34:20 -0800
>
>Maybe a race condition can be won between the times the setuid bits
>are changed by chown().
Don't bother trying, system calls are atomic... but you can use this
feature to work around filesystem quotas for example. I can't see any
other evil use of this feature : I can't see why giving a file to
somebody else could be harmful. Well, of course it can be done in
the wrong place, so a naive user who chmoded 777 his home directory
could be given a .rhosts...
OTOH, does this feature allow you to do it the other way round ?
Sort of things like :
chown myself /etc/passwd
vi /etc/passwd
chown root /etc/passwd
Well _that_ would be interesting enough :-).
>
>-Ed
--
<< Tout n'y est pas parfait, mais on y honore certainement les jardiniers >>
Dominique QUATRAVAUX
(Dominique.Quatravaux@ens.fr)
