From owner-freebsd-hackers@FreeBSD.ORG Sun Mar 28 23:19:01 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B9FE016A4CE for ; Sun, 28 Mar 2004 23:19:01 -0800 (PST) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 75CA943D39 for ; Sun, 28 Mar 2004 23:19:01 -0800 (PST) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.12.10/8.12.10) id i2T7J0ao015625; Mon, 29 Mar 2004 01:19:00 -0600 (CST) (envelope-from dan) Date: Mon, 29 Mar 2004 01:19:00 -0600 From: Dan Nelson To: Sean Kelly Message-ID: <20040329071857.GC19463@dan.emsphone.com> References: <6.0.3.0.2.20040329102508.029f5670@202.179.0.80> <20040329023937.GA76248@edgemaster.zombie.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040329023937.GA76248@edgemaster.zombie.org> X-OS: FreeBSD 5.2-CURRENT X-message-flag: Outlook Error User-Agent: Mutt/1.5.6i cc: freebsd-hackers@freebsd.org cc: Ganbold Subject: Re: Question regarding shell user creation at login time X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Mar 2004 07:19:01 -0000 In the last episode (Mar 28), Sean Kelly said: > On Mon, Mar 29, 2004 at 11:05:55AM +0900, Ganbold wrote: > > 10198 new CALL setuid(0) > > 10198 new RET setuid -1 errno 1 Operation not permitted > > Your attempt to setuid(0) failed. > > > 10198 new CALL execve(0x80485d0,0xbfbfed8c,0xbfbfed94) > > 10198 new NAMI "/home/new/new.pl" > > 10198 new RET execve -1 errno 13 Permission denied > > Your attempt to run that perl script failed. > > > -rwsr-x--- 1 root new 4651 Mar 26 08:47 new > > ---------- 1 root wheel 94 Mar 26 08:47 new.c > > -r-x------ 1 root wheel 15430 Mar 25 15:16 new.pl > > Well, since your attempt to setuid(0) failed, `new.pl` is not being > execve()'d as root. Therefore, the permissions on the `new.pl` file are > such that it can't be read or executed by the user/process. Ah, but if he is in fact running /home/new/new, which is setuid root, then the setuid(0) call (redundant) should have worked, and so should the exec. Ganbold: if you run /home/new/new as an ordinary user, does it work? I can't think of how ssh would be nullifying the setuid bit on that binary, but you never know. -- Dan Nelson dnelson@allantgroup.com