Re: suidperl
Tim Robbins <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.audit |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Jul 04, 2002 at 03:14:13PM +0300, Peter Pentchev wrote: > Are you sure that you do not have suidperl still hardlinked to 'perl', > exactly the hardlink that the first part of knu's patch removes? :) I just turned on the suid bit on /usr/bin/perl to test. The code in src/usr.bin/perl/perl.c isn't safe to run suid (or any time the effective user does not trust whoever set the PATH variable) because it runs arbitrary programs from directories in PATH. In any case, the way /usr/bin/perl relies on PATH to find the interpreter is unsafe to a lesser degree even with the suid bit turned off. Tim To Unsubscribe: send mail to [email protected] with "unsubscribe freebsd-audit" in the body of the message