Re: hardlinks to setuid binaries

On Fri, Mar 25, 2022 at 04:21:55PM +0100, Michael Richardson wrote:
> Jan Schaumann <[email protected]> wrote:
>     > Suppose you have a setuid /usr/pkg/bin/sudo from sudo version 1.8.11,
>     > which is vulnerable to CVE-2014-9680.  You create a hardlink in your
>     > home directory, so you get setuid, owned by root, mode 511 '~/sudo'.
> 
> So, that would require that all pieces be on the same partition.
> 

Well, hardlinks can only work within a single file system and/or mount
point to begin with..

	Jonathan

P.S
On some FSes you can't even hard link outside a single directory (AFS).