*BSD News Article 8547


Return to BSD News archive

Path: sserve!manuel.anu.edu.au!munnari.oz.au!news.hawaii.edu!ames!olivea!uunet!emba-news.uvm.edu!trantor.emba.uvm.edu!wollman
From: wollman@trantor.emba.uvm.edu (Garrett Wollman)
Newsgroups: comp.unix.bsd
Subject: Re: [386bsd] Fix for kern_execve to allow suid/sgid shellscipts
Message-ID: <1992Dec4.003541.244@uvm.edu>
Date: 4 Dec 92 00:35:41 GMT
References: <4165@wzv.win.tue.nl>
Sender: news@uvm.edu
Organization: University of Vermont, EMBA Computer Facility
Lines: 40

In article <4165@wzv.win.tue.nl> guido@gvr.win.tue.nl (Guido van Rooij) writes:
>I noticed that suid/sgid shellscripts dont work with the current 
>kern_execve.c. I made a quick hack to do so.
>Whenever a shellscript is found, the shell inherits the uid/gid
>(if one of the sbits was set of course). It's a quick hack
>as I said, but it works (so it seems ;-))
>Comments are welcome.


PLEASE PLEASE PLEASE DON'T APPLY THIS PATCH!!!
(And not just because it was backwards!)

There is a very good reason why set-id shell scripts are not
supported!  It's because they are a HUGE security hole in
implementations such as the one just posted.

If you want to do set-id shell scripts, you should either do them
right, or write your script in perl and use suidperl.  The right way
is to do the following:

First, install my /dev/fd patch, so that /dev/fd/nnn works.  (Terry,
why isn't this one in the patchkit?)  Now, when you open the script,
leave the vnode open and locked until the interpreter has been loaded.
Unlock the vnode and create a file descriptor for it (see the
definition of open() /sys/kern/kern_descrip.c for more info on how).
Now, in the argument slot where you would have passed the name of the
script, pass instead the string "/dev/fd/nnn", where nnn is the number
of the file descriptor you got in the previous step.  

Now you have safe set-id shell scripts.

You may find that it's easier to just give up and use suidperl.

-GAWollman

-- 
Garrett A. Wollman   | Shashish is simple, it's discreet, it's brief. ... 
wollman@emba.uvm.edu | Shashish is the bonding of hearts in spite of distance.
uvm-gen!wollman      | It is a bond more powerful than absence.  We like people
UVM disagrees.       | who like Shashish.  - Claude McKenzie + Florent Vollant