On Thu, Jan 02, 2003 at 10:47:32AM -0700, Craig Kelley wrote: > For some time now, I've been patching smbpasswd to get rid of the > effective UID "detection" that it does. In 2.2.7a it simply tests if the > effective UID differs from the real UID, and if the effective UID is > 'root' then it bails:
> /* Check the effective uid - make sure we are not setuid */ > if ((geteuid() == (uid_t)0) && (getuid() != (uid_t)0)) > This test will bail out if smbpasswd isn't suid 0, but the process that > calls it is (eg, a utility agent for changing passwords and such). I've > made a preliminary diff to actually stat() the executable to determine if > it is suid 0: Why does your suid application not either assume full root privileges, or drop all such privileges, before exec()ing smbpasswd? -- Steve Langasek postmodern programmer
msg05154/pgp00000.pgp
Description: PGP signature
