[rfc] change default setuid permissions from 4755 to 4711
Mike Frysinger <[email protected]> Tue, 2 Aug 2005 22:01:24 -0400
| Newsgroups | gmane.linux.pld.shadow.general |
|---|---|
| Organization | wh0rd.org |
| Message-ID | <[email protected]> |
we've been patching the permissions in shadow for a while now from 4755 to 4711 ... i dont think anyone here has asked the shadow maintainers, so i'm doing so now :) there's no need to grant read permissions for setuid binaries, so 4711 is just as functional as 4755, while keeping internal binary information (such as function addresses) hidden -mike
setuid-perms-4711.patch
(text/x-diff, 950 B)
Index: src/Makefile.am =================================================================== RCS file: /cvsroot/shadow/src/Makefile.am,v retrieving revision 1.44 diff -u -p -r1.44 Makefile.am --- src/Makefile.am 7 Jul 2005 08:40:27 -0000 1.44 +++ src/Makefile.am 3 Aug 2005 01:59:11 -0000 @@ -45,6 +45,8 @@ noinst_PROGRAMS = id sulogin suidbins = su suidubins = chage chfn chsh expiry gpasswd newgrp passwd +suidbinperms = 4711 +suidubinperms = 4711 LDADD = $(top_builddir)/libmisc/libmisc.a \ $(top_builddir)/lib/libshadow.la @@ -79,8 +81,8 @@ install-am: all-am ln -sf newgrp $(DESTDIR)$(ubindir)/sg ln -sf vipw $(DESTDIR)$(usbindir)/vigr for i in $(suidbins); do \ - chmod -f 4755 $(DESTDIR)$(bindir)/$$i; \ + chmod -f $(suidbinperms) $(DESTDIR)$(bindir)/$$i; \ done for i in $(suidubins); do \ - chmod -f 4755 $(DESTDIR)$(ubindir)/$$i; \ + chmod -f $(suidubinperms) $(DESTDIR)$(ubindir)/$$i; \ done