Re: bash

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Matthew Miller wrote:
On Wed, Dec 07, 2005 at 08:12:17AM -0500, Gene Heskett wrote:

Cos' that user is only allowed to do cp mv and chmod, not anything
else.

And thats enough to own the box.

How?

If he can cp and mv something malicious, then chown it to a lower numbered user, I think he could gain root privs if he was suitably creative. Maybe not, but it would certainly bear watching/logging IMO.


ch*mod*, not chown. :)

Regular users can't normally run chown anyway, because these "file giveaways" are a well-known security issue.

Paul.


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux