Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!asuvax!ncar!gatech!mcnc!uvaarpa!haven!mimsy!nocusuhs!nmrdc1!minixug!uwalt!waltje
From: waltje@uwalt.nl.mugnet.org (Fred 'The Rebel' van Kempen)
Newsgroups: comp.os.minix
Subject: Re: MINIX Security
Message-ID: <9103212014@uwalt.nl.mugnet.org>
Date: 21 Mar 91 17:08:48 GMT
References: <47976@nigel.ee.udel.edu>
Organization: MicroWalt Corporation, for MINIX Software Development
Lines: 36

In article <47976@nigel.ee.udel.edu>, u27602@uy.ncsa.uiuc.edu (Jeffrey C. Ollie) wrote:
> <AJN106@PSUVM.PSU.EDU> writes:
> 
>>HOW CAN I BREAK SECURITY IN MINIX 1.5?  IT IS FOR A PROJECT I AM DOING AS AN
>>INDEPENDENT STUDY.  I NEED A WAY TO ACCESS SUPER-USER (ROOT USER) PRIVILEGES
>>SO A NORMAL USER CAN USE IT.  SEND E-MAIL RESPONSES TO AJN106 PSUVM.  THANKS.
> 
> The book _Unix System Anministration_ by Evi Nemeth contains a short
> program called SUDO (SuperUser DO) that allows normal users to perform
> operations that normally only the root would be able to do.  Basically,
> it is a program that runs setuid root.  SUDO checks a file set up by
> the super-user to see if the su has given the user that runs SUDO permission
> to run SUDO, and if the su has given that user permission to execute the
> command given to su.  The program was written for BSD Unix, but there are
> no BSD-dependent calls (as far as I know) so a port should be a type-in-and-
> run job. ;-)
> 
> Jeff Ollie
> I-Net: u27602@uy.ncsa.uiuc.edu
> 

Every now and then, I ask system security people to have a go at my
machines.  Minixug is hard to crack, but even it gets cracked there's
nothing to get from it.

The other machine of importance here (uwalt) has lots of sources on
it, and is thus a more interesting goal.

Still, they were only able to get 3 bugs out of MINIX.  That is very
good, since MINIX is getting better and better this way :-)

In Short: cracking a properly set up MINIX system _can_ be hard...

Fred.
--
MicroWalt Corporation, for MINIX Development	waltje@uwalt.nl.mugnet.org
Tel (+31) 252 230 205, Hoefbladhof  27, 2215 DV  VOORHOUT, The Netherlands