Date: Thu, 23 Jul 2009 00:42:47 +0200 From: DarkSoul <darksoul@darkbsd.org> To: freebsd-hackers@FreeBSD.org Subject: Re: SGID/SUID on scripts Message-ID: <4A6795E7.7020700@darkbsd.org> In-Reply-To: <19939654343.20090722214221@mail.ru> References: <19939654343.20090722214221@mail.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Anthony Pankov wrote: > SGID/SUID bits don't work with shell scripts, do they? > > And no mention in chmod(1,2) manual. They don't. One reason for this, is that if they were applied, the following would occur : - execve() syscall reads your script's shebang line, and the script interpreter is executed, receiving the specified arguments along with the script name. - The interpreter then open()s the script file to read it, and run the code. The problem you then are faced with, is that you have a time frame defined by the moment between the aforementioned execve() and open(), during which it could be possible to unlink/move/whatever the shell script the interpreter is going to open. You guess where this is going, you have no absolute way of guaranteeing you are executing the file you initially planned on opening because execution/opening/reading is not, and can't be done atomically for shell scripts. Cheers, -- Stephane LAPIE, EPITA SRS, Promo 2005 "Even when they have digital readouts, I can't understand them." --MegaTokyo [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkpnleoACgkQ24Ql8u6TF2O1tgCfdle8/7o/bupd3ZUOJQ1s+G5l exAAmQHna0uKG23cndYoA8pWfICLDgRa =wxNm -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4A6795E7.7020700>