How to break user mode protections in 1 quick misstep!
Just like when an admin hands out sudo rights to run a custom script without locking down the script itself.
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
How to break user mode protections in 1 quick misstep!
Just like when an admin hands out sudo rights to run a custom script without locking down the script itself.
Bad idea
Avoid using sudo and setuid by writing your own sudo program using setuid?
How to run a shell script with root permisions without sudo? su to root. Or set up the correct permissions for the script and whatever it needs to touch, and add your user to any required groups, so that you don't need to be root to run the script. Rolling your own solution is never a good idea for anything security-related.
Or create a service running with limited access to specific resources, and create an API for users to make requests to that service.
Do you know how many times I've made some little bit of shell code "setuid" by writing a shitty little C program that just calls system()?