From owner-freebsd-security Wed Oct 4 2:19:51 2000 Delivered-To: freebsd-security@freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 04C9A37B503; Wed, 4 Oct 2000 02:19:49 -0700 (PDT) Received: (from kris@localhost) by freefall.freebsd.org (8.9.3/8.9.2) id CAA76923; Wed, 4 Oct 2000 02:19:48 -0700 (PDT) (envelope-from kris@FreeBSD.org) Date: Wed, 4 Oct 2000 02:19:48 -0700 From: Kris Kennaway To: Alfred Perlstein Cc: Kris Kennaway , Dima Dorfman , Mike Silbersack , security@FreeBSD.ORG Subject: Re: BSD chpass (fwd) Message-ID: <20001004021948.A76230@freefall.freebsd.org> References: <20001004053422.8A3901F19@static.unixfreak.org> <20001004021426.A74690@freefall.freebsd.org> <20001004021531.B74690@freefall.freebsd.org> <20001004021658.F27736@fw.wintelcom.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20001004021658.F27736@fw.wintelcom.net>; from bright@wintelcom.net on Wed, Oct 04, 2000 at 02:16:59AM -0700 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Wed, Oct 04, 2000 at 02:16:59AM -0700, Alfred Perlstein wrote: > * Kris Kennaway [001004 02:15] wrote: > > On Wed, Oct 04, 2000 at 02:14:26AM -0700, Kris Kennaway wrote: > > > On Tue, Oct 03, 2000 at 10:34:22PM -0700, Dima Dorfman wrote: > > > > > For those not subscribed to bugtraq, it's time to remove the suid bit on > > > > > chpass. > > > > > > > > Unfortunatly it isn't that easy if you're running with securelevel > 0 > > > > since chpass is installed with the schg (system immutable) flag on by > > > > default. Oh well, guess it's time to reboot some hosts. :-/ > > > > > > mv it into a mode 000 directory :-) > > > > Oops, can't do that. Reboot :) > > Can you mount something over it? Hmm, now that null mounts work in -current you could, actually - make a copy of /usr/bin except for chpass in say /usr/bin2 and null mount it on /usr/bin. Except securelevel disallows mounts, I think :) Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message