Re: F_SETOWN...

Ricky Beam (root@defiant.interpath.net)
Wed, 25 Nov 1998 08:34:16 -0500 (EST)


Letting the chips fall where they may, I quote David Luyer:
>> Durr.. thats like your own process 8) Try killing someone elses
>
>OK. Easy enough.

Actually, that's the same thing: (have someone else run the perl stuff)

[ttya1]foobar(ttyS0:S.2):~/[8:24am]:ls -l /tmp/foo
-rwsr-xr-x 1 root root 302732 Nov 25 08:22 /tmp/foo*
[ttya1]foobar(ttyS0:S.2):~/[8:24am]:/tmp/foo
[cramer@foobar cramer]# id
uid=500(cramer) gid=0(root) euid=0(root) groups=0(root),5(tty),6(disk),60(dba),
100(users),101(dcti),102(stats),103(logs),500(cramer)
[cramer@foobar cramer]# echo $$
13575
[cramer@foobar cramer]# Pollable event occured
[ttya1]foobar(ttyS0:S.2):~/[8:24am]:

[ttya4]foobar(ttyS0:S.3):~/[8:23am]:./shits 13575
Sending SIGIO - press enter.

SIGIO send attempted.
[ttya4]foobar(ttyS0:S.3):~/[8:24am]:

The SUID environment only resets the euid. The true owner of the process is
still "uid=500". If the uid of the processes don't match, then sigio doesn't
get sent. IMO, the fcntl() should have returned an error alerting the process
that what it thinks is setup isn't actually setup.

AND, I've still not gotten any feedback as to why this exists at all.

I'll have to look very closely at the send_sigio function to see if there is
any way to slide past the checks and get a signal sent to a process the user
doesn't own/didn't start.

--Ricky

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/