[5953] in bugtraq
Re: hole in sudo for MP-RAS.
daemon@ATHENA.MIT.EDU (Todd C. Miller)
Tue Jan 13 16:05:55 1998
Date: Mon, 12 Jan 1998 21:53:37 -0700
Reply-To: "Todd C. Miller" <Todd.Miller@COURTESAN.COM>
From: "Todd C. Miller" <Todd.Miller@COURTESAN.COM>
X-To: douglas-siebert@uiowa.edu
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: Your message of "Mon, 12 Jan 1998 22:02:53 CST."
<199801130402.WAA09191@l-ecn004.icaen.uiowa.edu>
In message <199801130402.WAA09191@l-ecn004.icaen.uiowa.edu>
so spake (dsiebert):
> Seems to me that fixing the "exclude" stuff in sudo is a bit harder than just
> verifying the path is on the exclude list. Any exclude list should default
> automaticaly to only letting you run stuff owned by root (or bin, or whatever
> owns your system binaries) Otherwise a user can just make a copy of (or
> compile) something banned. Though realistically, I don't see how you could
> make an exclude list complete enough to avoid letting a user run a shell, at
> which point the user can do anything anyway.
excluding things from 'ALL' is pretty much meaningless for the
reasons you've noted above. The exclusion facility is really only
useful for subtractings things from a real list...
- todd
