Date: Sat, 7 Oct 2000 16:51:01 -0400 From: Bill Fumerola <billf@chimesnet.com> To: Chris BeHanna <behanna@zbzoom.net> Cc: FreeBSD-Stable <stable@freebsd.org> Subject: Re: Security problem with "script"? Message-ID: <20001007165101.Q38472@jade.chc-chimes.com> In-Reply-To: <Pine.BSF.4.21.0010071640460.7433-100000@topperwein.dyndns.org>; from behanna@zbzoom.net on Sat, Oct 07, 2000 at 04:41:13PM -0400 References: <200010071807.MAA01420@harmony.village.org> <Pine.BSF.4.21.0010071640460.7433-100000@topperwein.dyndns.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Oct 07, 2000 at 04:41:13PM -0400, Chris BeHanna wrote:
> > : david@/usr/src % whoami
> > : david
> > : david@/usr/src % sudo script /usr/tmp/buildworld
> > : Script started, output file is /usr/tmp/buildworld
> > : root@/usr/src % whoami
> > : root
> > : root@/usr/src %
> > :
> > : Is this a security problem?
> >
> > No. script forks a shell. sudo tells you to do that as root. It is
> > merely complying.
>
> Er, wouldn't that give a user root access to do anything he or she
> wanted?
Isn't that the point of sudo? I can't believe this thread even exists...
--
Bill Fumerola - Network Architect, BOFH / Chimes, Inc.
billf@chimesnet.com / billf@FreeBSD.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001007165101.Q38472>