Re: [Devil-linux-develop] [PATCH] build/scripts/scripts/save-config - security hole?

[Tim <t....@co...>]

Bruce Smith wrote:

>>While I'm on the topic, I think another pontential hole is the linuxrc 
>>script that discovers the etc.tar.bz2 file on boot... since multiple 
>>locations are checked, if an unpriveleged user can introduce an 
>>etc.tar.bz2 file onto a drive that is checked before the real one, then 
>>they can control the machine on the next reboot. We should check the 
>>file for "root" ownership and that it is not writeable by anyone else 
>>before loading it. Of course not being a bash master I'm not sure how to 
>>write that...
>>    
>>
>
>That won't work because a regular user could run "chmod 600 etc.tar.bz2"
>and then a "chown root etc.tar.bz2" once they are done creating it. 
>(unless we restrict execution of chown/chmod only to root)
>
>You'll have to make sure a normal user doesn't have write access to the
>root directory of any partition checked by linuxrc.  Unless you have
>another idea .... ?
>
> - BS
>
Not true, a non-priveleged user can't reassign ownership to another 
user... I ran a quick test and confirmed it on my box.

Tim