From owner-freebsd-security  Tue Sep 21  0:19:28 1999
Delivered-To: freebsd-security@freebsd.org
Received: from www.svzserv.kemerovo.su (www.svzserv.kemerovo.su [194.58.85.161])
	by hub.freebsd.org (Postfix) with ESMTP id 66FD91511E
	for <security@FreeBSD.ORG>; Tue, 21 Sep 1999 00:19:08 -0700 (PDT)
	(envelope-from eugen@svzserv.kemerovo.su)
Received: from svzserv.kemerovo.su (kost.svzserv.kemerovo.su [194.58.85.163])
	by www.svzserv.kemerovo.su (8.9.2/8.9.2) with ESMTP id HAA25277
	for <security@FreeBSD.ORG>; Tue, 21 Sep 1999 07:19:00 GMT
Message-ID: <37E73FCA.1DF0C8DF@svzserv.kemerovo.su>
Date: Tue, 21 Sep 1999 15:20:26 +0700
From: Eugene Grosbein <eugen@svzserv.kemerovo.su>
Organization: SVZSERV Co.
X-Mailer: Mozilla 4.61 [en] (Win95; I)
X-Accept-Language: ru,en
MIME-Version: 1.0
To: security@FreeBSD.ORG
Subject: /usr/sbin/edquota says "Permission denied" if(getuid())
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Hello!

I have root-owned suid-marked CGI-BIN program
that creates new users via /usr/sbin/pw.

It also should set userquotas via 
/usr/sbin/edquota -p template_username -u new_username

But when equota starts, getuid()==65534 and geteuid()==0
and edquota complains :(
What is the reason using getuid() and not geteuid()?

Eugene Grosbein


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message