sm-grimoire AT lists.ibiblio.org
Subject: Discussion of Spells and Grimoire items
List archive
- From: julian AT openit.de (Julian v. Bock)
- To: Sergey A Lipnevich <sergeyli AT pisem.net>
- Cc: eric AT sandall.us, Source Mage - Grimoire <sm-grimoire AT lists.ibiblio.org>
- Subject: Re: [SM-Grimoire]Security hole + fix for /tmp
- Date: Mon, 07 Oct 2002 21:49:06 +0200
Hi
>>>>> "SAL" == Sergey A Lipnevich <sergeyli AT pisem.net> writes:
SAL> sorcery creates scripts like /tmp/sorcery-update.sh in there,
SAL> AFAIR. They'll need to be copied somewhere to be executed, or
SAL> sourced?
Furthermore, it is _extremely_ simple to circumvent the noexec flag.
Simply use /lib/ld-linux /tmp/prog instead of /tmp/prog for
executables, or /bin/bash /tmp/prog.sh for shell scripts.
The nosuid flag might make sense.
Julian
-
[SM-Grimoire]Security hole + fix for /tmp,
Eric Sandall, 10/07/2002
-
Re: [SM-Grimoire]Security hole + fix for /tmp,
Sergey A Lipnevich, 10/07/2002
- Re: [SM-Grimoire]Security hole + fix for /tmp, Julian v. Bock, 10/07/2002
- Re: [SM-Grimoire]Security hole + fix for /tmp, Dufflebunk, 10/07/2002
-
Re: [SM-Grimoire]Security hole + fix for /tmp,
Sergey A Lipnevich, 10/07/2002
Archive powered by MHonArc 2.6.24.