Date: Wed, 25 Jul 2001 19:20:45 -0700 From: Kris Kennaway <kris@obsecurity.org> To: Sheldon Hearn <sheldonh@starjuice.net> Cc: current@FreeBSD.org Subject: Re: su root broken in -CURRENT Message-ID: <20010725192044.C3833@xor.obsecurity.org> In-Reply-To: <65545.996111975@axl.seasidesoftware.co.za>; from sheldonh@starjuice.net on Thu, Jul 26, 2001 at 03:46:15AM %2B0200 References: <30911.996110138@axl.seasidesoftware.co.za> <65545.996111975@axl.seasidesoftware.co.za>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Thu, Jul 26, 2001 at 03:46:15AM +0200, Sheldon Hearn wrote: > > > On Thu, 26 Jul 2001 03:15:38 +0200, Sheldon Hearn wrote: > > > I've completed a pretty clean crossgrade [1] to -CURRENT and find that > > su is broken. I thought this had been fixed. > > > > I have a virgin rev 1.17 /etc/pam.conf, I'm in group wheel, I built > > world with no funky options, the su binary (built from su rev 1.39) > > really is setuid root and yet I get the amazingly helpful error message: > > > > su: Sorry > > Found it. pam_wheel is a whore. It doesn't use getgid() or getegid(), > but instead grovels through /etc/group manually. > > I'm in group wheel by virtue of the fact that my GID specified in the > passwd file is 0. I don't have to be in /etc/group. > > Unless, of course, I want to su. :-) Isn't this backwards? Code shouldn't be making assumptions about the special meaning of numeric gids. What if you wanted to renumber gid wheel to something else? Kris [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE7X358Wry0BWjoQKURAtO2AJ9JLkbLDaZDqyHv/0/vCSjTouWYqwCg9YR8 SUvzwrrYca0j+jCthAjV6Gk= =SYRb -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010725192044.C3833>