O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Appendix B] B.3 SUID and SGID Files
---s--x--x 1 uucp uucp 21304 Jul 15 1994 /usr/bin/uuglist
---s--x--x 1 uucp uucp 17144 Jul 15 1994 /usr/bin/uuname
---s--x--x 1 uucp uucp 60952 Jul 15 1994 /usr/bin/uustat
---s--x--x 1 uucp uucp 68040 Jul 15 1994 /usr/bin/uux
---s--x--x 1 uucp uucp 4816 Jul 15 1994 /usr/lib/uucp/remote.unknown
---s--x--x 1 uucp uucp 169096 Jul 15 1994 /usr/lib/uucp/uucico
---s--x--x 1 uucp uucp 32016 Jul 15 1994 /usr/lib/uucp/uusched
---s--x--x 1 uucp uucp 81040 Jul 15 1994 /usr/lib/uucp/uuxqt
These programs are SUID uucp because they need to access privileged UUCP directories and files.
-r-sr-xr-x 1 root bin 21496 Jul 16 1994 /usr/lib/exrecover
This file is SUID root so that it can access the directory in which editor recovery files are saved. As we have said in other
places in the book, a more secure approach would be to have an account specifically created for accessing this directory, or to
create user-owned subdirectories in a common save directory.
-r-sr-sr-x 1 root tty 151352 Jul 15 1994 /usr/lib/fs/ufs/ufsdump
-r-sr-xr-x 1 root bin 605348 Jul 15 1994 /usr/lib/fs/ufs/ufsrestore
These files are SUID root so that users other than the superuser can make backups. In the Solaris version of these commands,
any user who is in the sys group can dump the contents of the system's disks and restore them without having root access. (As
a result, having sys access on this operating system means that you can effectively read any file on the computer by using a
combination of ufsdump and ufsrestore.) Note: the fact that users in the sys group can dump and undump tapes is not
documented in the man page. Other programs may give undocumented privileges to users who happen to be in particular
groups.
-rwsr-xr-x 1 root adm 4008 Jul 15 1994 /usr/lib/acct/accton
There must be some reason that this program is SUID root. But, once again, we can't figure it out, as the program gives the
error "permission denied" when it is run by anybody other than the superuser.
-rwsr-xr-x 3 root bin 13944 Jul 16 1994 /usr/sbin/allocate
-rwsr-xr-x 3 root bin 13944 Jul 16 1994 /usr/sbin/deallocate
-rwsr-xr-x 3 root bin 13944 Jul 16 1994 /usr/sbin/list_devices
The allocate command allocates devices to users based on the Solaris allocation mechanism. For more information, refer to
the Solaris documentation. We believe that the mkdevalloc and mkdevmaps commands are part of the same system, but they
are not documented.
-rwsr-xr-x 1 root sys 21600 Jul 16 1994 /usr/sbin/sacadm
The sacadm is the top-level entry point into the Service Access Facility system.
-rwsrwxr-x 1 root bin 87808 Jun 24 1994 /usr/openwin/bin/xlock
We think that xlock needs to be SUID root so that it can read your password from the shadow file.
-r-sr-sr-x 1 root sys 20968 Jun 27 1995 /usr/dt/bin/dtaction
-r-sr-xr-x 1 root bin 69172 Jun 27 1995 /usr/dt/bin/dtappgather
-r-sr-xr-x 1 root bin 134600 Jun 27 1995 /usr/dt/bin/dtsession
-r-sr-xr-x 1 root bin 373332 Jun 27 1995 /usr/dt/bin/dtprintinfo
-r-sr-sr-x 1 root daemon 278060 Jun 27 1995 /usr/dt/bin/sdtcm_convert
These programs all appear to perform session management as part of the Common Desktop Environment 1.0. We don't know
why dtaction needs to be SUID root.
B.3.1.2 Undocumented SUID programs
The following programs are SUID and undocumented. This combination is dangerous, because there is no way to tell for sure
what these programs are supposed to do, if they have their SUID/SGID bits properly set, or if they are even part of the
standard operating system release.
---s--x--x 1 root bin 3116 Jul 16 1994 /usr/lib/pt_chmod
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/appb_03.htm (3 of 7) [2002-04-12 10:45:19]