Re: suid clarification

From: Barry Margolin (barmar_at_alum.mit.edu)
Date: 10/31/05 

Date: Mon, 31 Oct 2005 01:39:34 -0500

In article <1130641587.552562.88220@g14g2000cwa.googlegroups.com>,
 "puzzlecracker" <ironsel2000@gmail.com> wrote:

> Here is my configuration:
>
> User A owns a program , let's call it printer that has suid bit set.It
> accepts a list of files from different users. For each such file, it
> should (if the file is readable by the actual user) and run a command,
> result of which should be writen to a file only writable by user A.
>
> User B passes run a program owned A.
>
> What happens if the user A doesn't any permissions for files readable
> by B, can it still run a command for the file is now accessed with
> effective permissions of A?
>
>
>
> Is it enough to chmod 644 output file (where the User's A program
> prints an output from the command)" to prevent any security holes?

The program should use seteuid() to change to B, open the input file,
then use seteuid() to change back to A and write the output file. 

-- 
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***

Relevant Pages

  • Process header record and concatenate files
    ... Concatenate the input files into a single output file. ... records reported in the header, ... Specify the list of input files on the command line. ... rewind to beginning of file handle and concat to ...
    (comp.lang.perl.misc)
  • Re: Process header record and concatenate files
    ... Concatenate the input files into a single output file. ... records reported in the header, ... Specify the list of input files on the command line. ... rewind to beginning of file handle and concat to ...
    (comp.lang.perl.misc)
  • SMTP: How to configure? Cant get Email from AS/400
    ... When sending mail to internet user I got successful message. ... I added the command: STRSBS QSNADS because the distribution queue status ... Member DSTLINFO added to output file DSTLINFO in library QTEMP. ...
    (comp.sys.ibm.as400.misc)
  • Re: Script help: convert music files to be compatible with MPD
    ... command will be written to it. ... I tried it with both> and>> and with the file both left and right of the escaped semicolon. ... It looks as if find redirects its own output file or pipe and then runs external commands with its outputs spliced onto its own output channels. ... cat /dev/null> $@ ...
    (uk.comp.os.linux)
  • Re: Job owned by a non-sysadmin fails to run
    ... Do you have any CmdExec job steps that successfully run as non-sysadmin users or is it just dmlrun.exe that has the problem? ... I tried to get command output in a different way. ... The folder where the output file is written has "full control" permission granted to everyone. ... This could be due to a different environment or the way the program retrieves configuration information under the different execution contexts. ...
    (microsoft.public.sqlserver.security)