Date: Wed, 27 Mar 2002 09:00:06 -0500 From: Bill Vermillion <bv@wjv.com> To: security@freebsd.org Subject: Question on su / possible hole Message-ID: <20020327140006.GA30556@wjv.com>
next in thread | raw e-mail | index | archive | help
I don't know if this is where I should ask, so apologies if it's the wrong place. There is a wheel group and only people who are in the wheel group are to be able to su to the root account. I like that approach because even if people has the root password they can't su to root. However I have found that if non-wheel-group user can su to a user who has wheel privledges - the the non-wheel user can su to root. Since BSD doesn't use the EUID/EGID methods in SysV so you know who the user is in reality, it would seem perhaps logical to use the login id of the person to check wheel group privledges. I have noted that this appears to me anyway, and may have missed something else, that this is only way you can tell who the original user is. Because of this way to bypass not having a wheel group entry for a user - this seems to me to be a potential security hole. IOW if you have made sure those in wheel are authenticated so you know for sure who they are you may assume that they are safe. I realize that it falls back to the user in the wheel group who has had their password compromised. It just strike me as odd with all the other safeguards in place that this one can occur. Does anyone know the reason behind this design, it it was done this way purposely. Am I being overly paranoid about this? Thanks. Bill -- Bill Vermillion - bv @ wjv . com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020327140006.GA30556>