chown and security

Andries.Brouwer@cwi.nl
Sun, 8 Feb 1998 00:36:16 +0100 (MET)


Updating the man pages for system calls, I noticed
that we have an lchown these days. Hopefully everybody
is aware of the fact that every old chown(1) is now a
security risk on every recent Linux system.
["chown -R foo /home/bar" will now change the ownership
of /etc/passwd if there was a symbolic link to that
under /home/bar.]

>From chown.2:
NOTES
In versions of Linux prior to 2.1.81 (and distinct from
2.1.46), chown did not follow symbolic links. Since Linux
2.1.81, chown does follow symbolic links, and there is a
new system call lchown that does not follow symbolic
links. Note that this makes old binaries of chown(1) a
security risk on new Linux systems.

Probably I'll put a fixed chown.c (from fileutils-3.16,
with a --from option added) on ftp.win.tue.nl:/pub/linux/util .

Andries

PS 1. Please correct me if I misread the sources. I have not tested anything.
PS 2. The new system calls rt_sig*, pread, pwrite (numbers 173-181)
have not been documented yet. Contributions are welcome.
PS 3. Reactions to aeb@cwi.nl - I do not read linux-kernel.

[PPS It was amusing to see the reactions last time I made
this same remark. People sent me elaborate scripts
to get some of the functionality of nn into a mail reader,
mentioned http://www.uwsg.indiana.edu/hypermail/linux/kernel,
and told me of secret places where nntp servers would give me
linux.dev.kernel, provided I wouldn't tell David Miller.
Thanks to you all.]

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu