Path: utzoo!attcan!uunet!tut.cis.ohio-state.edu!pacific.mps.ohio-state.edu!zaphod.mps.ohio-state.edu!uwm.edu!rutgers!mephisto!bloom-beacon!eru!hagbard!sunic!mcsun!ukc!stl!robobar!ronald
From: ronald@robobar.co.uk (Ronald S H Khoo)
Newsgroups: comp.unix.sysv386
Subject: setluid(0) in SCO ?
Keywords: Defeat SCO C2 Security
Message-ID: <1990Sep20.163355.7147@robobar.co.uk>
Date: 20 Sep 90 16:33:55 GMT
Sender: ronald@robobar.co.uk (Ronald S H Khoo)
Organization: Robobar Ltd., Perivale, Middx., ENGLAND.
Lines: 14
To: sco-list@uunet.uu.net

Can anyone think of any breaches of unix levels of security if one
were to simply leave the login uid as zero ?  The silly authorisation
system seems to look only at the luid but the normal Unix checks seem
to apply to the normal (e)uid so it seems to me that if the luid were
simply always set to zero (by replacing /bin/login, I guess) then we
would effectively have just normal Unix behaviour.

Have I overlooked something obvious ? 

If not,  I wonder if SCO can be persuaded to supply such a replacement
/bin/login :-) (or someone go and sneak this into their distribution
masters  <evil grin> :-) :-))
-- 
my .signature is on holiday