From owner-freebsd-isp Thu Sep 14 17:53:49 2000 Delivered-To: freebsd-isp@freebsd.org Received: from atlas.bit.net.au (atlas.bit.net.au [203.18.94.3]) by hub.freebsd.org (Postfix) with ESMTP id B638F37B424 for ; Thu, 14 Sep 2000 17:53:46 -0700 (PDT) Received: (from pdh@localhost) by atlas.bit.net.au (8.9.3/8.9.3/Debian/GNU) id KAA16875; Fri, 15 Sep 2000 10:53:22 +1000 Date: Fri, 15 Sep 2000 10:53:22 +1000 From: Phil Homewood To: mike@mikesweb.com Cc: freebsd-isp@FreeBSD.ORG Subject: Re: make is suid? Message-ID: <20000915105322.D13125@atlas.bit.net.au> References: <4.3.2.7.2.20000914203236.00ba1c10@mail.mikesweb.com> <20000914203550.M47559@jade.chc-chimes.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0.1i In-Reply-To: <20000914203550.M47559@jade.chc-chimes.com>; from billf@chimesnet.com on Thu, Sep 14, 2000 at 08:35:50PM -0400 Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Bill Fumerola wrote: > On Thu, Sep 14, 2000 at 08:33:28PM -0400, Mike wrote: > > I noticed that make is suid root. > > -rwxr-sr-x 1 root kmem 442384 Aug 25 05:51 > > /usr/local/bin/make > > I'd suspect that your machine has had a compromise, if I were you. I'm betting the same, too. That file size looks *very* similar to 4.x's /bin/sh, in fact. (And that's sgid, not suid, by the way.) Make normally lives in /usr/bin, not /usr/local/bin; gmake installs as /usr/local/bin/gmake. -- Phil Homewood pdh@asiaonline.net Senior Technician +61 7 3620 1930 Asia Online (Brisbane) http://www.asiaonline.net/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message