0

I've learnt the following symlink is insecure because sometime i use vim to edit file by sudo:

xiaobai@dnxb:/tmp$ sudo find -L /root \! -user root 
/root/.vimrc
xiaobai@dnxb:/tmp$ ls -lathi /root/.vimrc
25 lrwxrwxrwx 1 root root 20 Oct  3 23:22 /root/.vimrc -> /home/xiaobai/.vimrc
xiaobai@dnxb:/tmp$ ls -lathiL /root/.vimrc
12330229 -rw-r--r-- 1 xiaobai xiaobai 6.1K Oct 12 02:22 /root/.vimrc
xiaobai@dnxb:/tmp$ 

But how about this file:

[xiaobai@localhost tmp]$ sudo find -L /bin \! -user root
/bin/sp-sc-auth
[xiaobai@localhost tmp]$ ls -lahi /bin/sp-sc-auth
1844640 lrwxrwxrwx. 1 root root 49 Aug 14 21:10 /bin/sp-sc-auth -> /home/xiaobai/note/src/sopcast/sp-auth/sp-sc-auth
[xiaobai@localhost tmp]$ ls -lahiL /bin/sp-sc-auth
6164581 -rwxrwxr-x. 1 xiaobai xiaobai 839K Aug 14 21:09 /bin/sp-sc-auth
[xiaobai@localhost tmp]$

I run sopcast-player without sudo/su, so should i worry about it ? Is it possible attacker take advantage of this kind of file which owned by normal user located in system $PATH but not executed directly by sudo/su ? And how about if gid is same group of normal user ?

0

Any program or script that is run by a user, whether that user is root or an ordinary account, will run with the privileges associated with the account running the program.

When you have root running a program, the program can do everything that root can do.

If you have a program owned by an ordinary user that is executed by root, that user therefore implicitly has root access because the program can do anything that the user has programmed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.