Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.3 alpha 4/3/85; site ukma.UUCP
Path: utzoo!watmath!clyde!cbosgd!ukma!david
From: david@ukma.UUCP (David Herron, NPR Lover)
Newsgroups: net.unix-wizards,net.bugs.uucp
Subject: Difference in Ultrix (uucp/uu{en,de}code)
Message-ID: <2766@ukma.UUCP>
Date: Thu, 27-Feb-86 10:15:03 EST
Article-I.D.: ukma.2766
Posted: Thu Feb 27 10:15:03 1986
Date-Received: Fri, 28-Feb-86 22:43:56 EST
Organization: U of Kentucky, Mathematical Sciences, Lexington KY
Lines: 26
Xref: watmath net.unix-wizards:16966 net.bugs.uucp:708

A friend who runs an Ultrix machine ran across an interesting
change with uucp on Ultrix.  (He's not done much with Unix
before.  I was giving him some software, using uuencoded files
to get it there, but he had troubles unpacking it).

For some reason uu{en,de}code are owned by uucp and set[ug]id
to boot!  WHY?????  It was very surprising for my friend when
he said "uudecode file" and it said "file: permission denied"
or whatever that protection message is.  And then he su'd to
try again as root and still got the same message!  Sheesh.

Why did DEC do this?  (uu{en,de}code in the 4.2 distribution
gets installed owned by root and no set[ug]id, so DEC definitely
changed this...)

Fortunately this isn't a security hole.  I created a uuencoding
of /bin/sh, editted the file to put set[ug]id to the resulting
file, then uudecoded it.  The file was owned by uucp, but not 
set[ug]id.
-- 
David Herron,  cbosgd!ukma!david, david@UKMA.BITNET, david@uky.csnet
							  ^
			Notice new and improved address---|

Postmaster for Kentucky
"'New and improved' is a misnomer" -- David Herron, 1986