Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!utgpu!water!watnot!watmath!clyde!rutgers!sri-spam!mordor!lll-lcc!ptsfa!ssl
From: ssl@ptsfa.UUCP
Newsgroups: comp.unix.wizards,comp.unix.questions
Subject: Re: UNIX file setuid sucurity hole?
Message-ID: <2195@ptsfa.UUCP>
Date: Fri, 13-Mar-87 10:29:03 EST
Article-I.D.: ptsfa.2195
Posted: Fri Mar 13 10:29:03 1987
Date-Received: Sat, 14-Mar-87 10:56:12 EST
References: <2168@ncoast.UUCP> <695@aw.sei.cmu.edu.sei.cmu.edu>
Reply-To: ssl@ptsfa.UUCP (Sam Lok)
Distribution: world
Organization: Pacific * Bell, San Ramon, CA
Lines: 23
Xref: utgpu comp.unix.wizards:1368 comp.unix.questions:1359

In article <695@aw.sei.cmu.edu.sei.cmu.edu> pdb@sei.cmu.edu.UUCP (Pat Barron) writes:
>In article <2168@ncoast.UUCP> robertd@ncoast.UUCP (Robert DeMarco) writes:
>>	It just accured to me that, 
>>thanks to the chown command and "setuid
>>to owner when executing this C program"
>>that no ones file is realy safe.
>>
>Easy.  Remember, unless you are the super-user, you can't use the chown command
>at all, not even to chown one of your own files.

Hold it, folks, what version of UNIX you guys are talking about.
On AT&T's SVR2, we don't really have much problem.  'chown' is used
to change ownership only, and 'chmod' is used to set file mode, setuid,
sticky bit and stuffs.  We can only 'chown' and 'chmod' by a file's owner,
and 'chown' is smart enough to reset the suid bit when a file's ownership
is released to another id.  It came this way from AT&T, and we never had
to hack with the kernel.

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Sam Lok		San Francisco		{ihnp4,pyramid,qantel}!ptsfa!ssl
				|| To err is human, to really foul things
I disclaim my disclaimer!	|| up requires super-user privilege!