Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!usc!cs.utexas.edu!sun-barr!newstop!central!convex!usenet
From: tchrist@convex.COM (Tom Christiansen)
Newsgroups: comp.unix.questions
Subject: Re: Changing GID inside csh script
Message-ID: <1991May16.124127.26781@convex.com>
Date: 16 May 91 12:41:27 GMT
References: <1991May14.182305.13872@lonex.radc.af.mil> <1991May15.142045.16808@ssd.kodak.com>
Sender: usenet@convex.com (news access account)
Reply-To: tchrist@convex.COM (Tom Christiansen)
Organization: CONVEX Software Development, Richardson, TX
Lines: 31
Nntp-Posting-Host: pixel.convex.com

From the keyboard of weimer@ssd.kodak.com:
:example% chgrp cad <script>
:example% chmod g+s <script>
:
:(assuming <script> is the script that is being run)
:
:This will change the group of the script to 'cad' and then set the group
:id  on execution.

Because if it works as you want it to work (and won't on all systems),
then it will in all likelihood also allow anyone who cares to bother to
execute any arbitrary command as group cad, including:

    cp /bin/sh /tmp/cad
    chmod g+s /tmp/cad

Perhaps this doesn't bother you.  It would bother me.

Why should this be, you ask?  Because this is one of those lurking
security holes that few vendors if any have ever bothered to fix or to
tell their customers about.  On most systems that support them, a suid
script allows you to execute arbitrary commands under that uid, and a g+s
script does the same for that gid.  Never have such on your system
unless you can prove that you don't have the bug: inspection of the 
kernel code for execve() is usually enough to tell.  If your system
doesn't have /dev/fd's, I doubt whether it's fixed.

--tom
--
Tom Christiansen		tchrist@convex.com	convex!tchrist
		"So much mail, so little time."