Re: hardlinks to setuid binaries

Michael Richardson <[email protected]> wrote:
> Jan Schaumann <[email protected]> wrote:
>     > Suppose you have a setuid /usr/pkg/bin/sudo from sudo version 1.8.11,
>     > which is vulnerable to CVE-2014-9680.  You create a hardlink in your
>     > home directory, so you get setuid, owned by root, mode 511 '~/sudo'.
> 
> So, that would require that all pieces be on the same partition.
> 
> I would claim that /home should be mounted nosuid, and that it wasn't is
> really the bug.

Ok, so repeat the example on the same partition, say
/var/tmp (which, even if /tmp is more commonly now a
tmpfs, may not be).

I don't think demanding that all installs everywhere
have a 100% clean separation of setuid binaries from
user writable directories is a realistic solution.

FWIW, FreeBSD also seems to prohibit this; I haven't
checked OpenBSD.

-Jan