Re: time limits

Daniel Barlow (jo95004@sable.ox.ac.uk)
Sat, 17 Feb 1996 18:46:18 GMT


>>> program that should kill sessions in /etc/profile and make it setuid
>>> to root.
>>
>>Don't forget about the users who aren't using /bin/(ba)sh !
>What's so special about /bin/(ba)sh ?

*csh don't run /etc/profile.

>>Also, having the program suid to root is not enough to guarantee that
>>the user can't kill it. Try doing this:
>
>There is *NO WAY* a normal user can kill processes owned by root.
>If you will ever do this (correctly) you will get a message telling
>you that you are not the owner of the process. If UNIX would that
>dumb, I would have switched to ms-dos a long time ago.

_suid_ root. Watch:

$ ls -l /bin/ping
-r-sr-xr-x 1 root bin 8716 Jul 25 1995 /bin/ping
$ ping localhost >/dev/null &
[1] 24502
$ jobs -l
[1] + 24502 running ping localhost > /dev/null
$ kill 24502
$
[1] + terminated ping localhost > /dev/null

Kindly test whereof you speak.

>in the kernel (which I doubt). In a decently implemented unix system,
>this shouldn't be possible.

It is possible on Linux (just tried it) and OSF/1 3.2c (again, tried
it). I suspect it's possible almost everywhere. Granted there is
some possibility for debate over whether OSF/1 is `decent', but I
don't think linux-kernel is the appropriate place for it.

Daniel

-- 
Web: http://www.sjc.ox.ac.uk/users/barlow   Mail: daniel.barlow@sjc.ox.ac.uk 

panic("bad_user_access_length executed (not cool, dude)");