Date: Thu, 23 Jul 2009 00:42:47 +0200 From: DarkSoul <darksoul@darkbsd.org> To: freebsd-hackers@FreeBSD.org Subject: Re: SGID/SUID on scripts Message-ID: <4A6795E7.7020700@darkbsd.org> In-Reply-To: <19939654343.20090722214221@mail.ru> References: <19939654343.20090722214221@mail.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigD4A4E0D5EA05166AC3E85EFF Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Anthony Pankov wrote: > SGID/SUID bits don't work with shell scripts, do they? >=20 > And no mention in chmod(1,2) manual. They don't. One reason for this, is that if they were applied, the following would occur : - execve() syscall reads your script's shebang line, and the script interpreter is executed, receiving the specified arguments along with the script name. - The interpreter then open()s the script file to read it, and run the co= de. The problem you then are faced with, is that you have a time frame defined by the moment between the aforementioned execve() and open(), during which it could be possible to unlink/move/whatever the shell script the interpreter is going to open. You guess where this is going, you have no absolute way of guaranteeing you are executing the file you initially planned on opening because execution/opening/reading is not, and can't be done atomically for shell scripts. Cheers, --=20 Stephane LAPIE, EPITA SRS, Promo 2005 "Even when they have digital readouts, I can't understand them." --MegaTokyo --------------enigD4A4E0D5EA05166AC3E85EFF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkpnleoACgkQ24Ql8u6TF2O1tgCfdle8/7o/bupd3ZUOJQ1s+G5l exAAmQHna0uKG23cndYoA8pWfICLDgRa =wxNm -----END PGP SIGNATURE----- --------------enigD4A4E0D5EA05166AC3E85EFF--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4A6795E7.7020700>