Re: [Security-Discuss] Xine accessing /etc/passwd ????

* Mark Ouellet <[email protected]> [2006-05-21 20:16:25 -0400]:

> > if you use strace, you will see that ls and most process actually
> > read /etc/passwd to have information like the username, the group, etc
> > etc. And so does xine.
> >
> > This is a normal behavior.
> 
> Ok, but, I wasn't working as root at the time and that is the entry xine read 
> from the ect/passwd, not the entry for my current user. I can understand 
> reading the password file for the reason you mentionned. Which would mean 
> reading the entry for "spook" in my example. But I don't understand why it 
> was looking at "root" instead?
> 
> > And, the file /etc/passwd is world readable because it no longer contain
> > anything sensitive since years.
> > The hash of the password is in /etc/shadow, as explained on almost unix
> > tutorial on the subject.
> 
> Yes, thanks. I'm well aware of the shadow file. And allthough the shadow files 
> have existed for a while, don't assume everyone is using an up to date 
> version of their OS. I'm sure hackers don't make that assumption. In fact 
> hackers make it a point to try every know trick in the book counting on the 
> fact that you are NOT using the latest version and still haven't plugged some 
> of the holes.

An strace will always show root being accessed in /etc/passwd and it's
not that the app is deliberately trying to get info about root but
rather that root is, more often than not, the first listed entry and the
strace shows the first line or two from the file being access which, in
the case of /etc/passwd, is root.  It's most likely looking up *your*
id, but strace doesn't single out what it's looking for, but rather that
it opened that file for reading and just shows the first bit of what is
being read in.

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}
Wasting time like it was free...

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iD8DBQFEceDTLrxeMv7jCtQRAssgAJ0T2jpNObEWzr2GDWeC15OJ4ppnQgCfbA3O
2M9u11XvRWktQV5mAdlnmqA=
=jjW0
-----END PGP SIGNATURE-----