From owner-freebsd-hackers Mon Oct 23 18:05:43 1995 Return-Path: owner-hackers Received: (from root@localhost) by freefall.freebsd.org (8.6.12/8.6.6) id SAA15419 for hackers-outgoing; Mon, 23 Oct 1995 18:05:43 -0700 Received: from seattle.polstra.com (seattle.polstra.com [198.211.214.4]) by freefall.freebsd.org (8.6.12/8.6.6) with SMTP id SAA15408 for ; Mon, 23 Oct 1995 18:05:38 -0700 Received: by seattle.polstra.com (Smail3.1.28.1 #5) id m0t7Xo8-000078C; Mon, 23 Oct 95 18:05 PDT Message-Id: Date: Mon, 23 Oct 95 18:05 PDT From: jdp@polstra.com (John Polstra) To: ache@freefall.freebsd.org Cc: freebsd-hackers@freebsd.org, gibbs@freefall.freebsd.org Subject: Re: ld.so, LD_NOSTD_PATH, and suid/sgid programs Sender: owner-hackers@freebsd.org Precedence: bulk > >Bogus argument in my opinion. The people who are going to use > >LD_NOSTD_PATH will know its effects. If you still want to argue > >about this, fine, but I'd like to put this issue to a vote. > > Yes, it can be used by intruder for hackers purposes, if he examine > previously what script does. I don't think it can be used for hacking purposes. All it can possibly do is make a command fail to execute at all. Any shell script would have to be pretty silly to permit that to result in a security breach. If you're going to worry about LD_NOSTD_PATH in ld.so, then why not also have it reset PATH, IFS, DISPLAY, and many other environment variables? (I am *not* recommending that!). > Ok with me, lets put this issue to a vote. Who gets to vote? John Polstra jdp@polstra.com Polstra & Co., Inc. Seattle, Washington USA "Self-knowledge is always bad news." -- John Barth