I've learnt the following symlink is insecure because sometime i use vim to edit file by sudo:
xiaobai@dnxb:/tmp$ sudo find -L /root \! -user root /root/.vimrc xiaobai@dnxb:/tmp$ ls -lathi /root/.vimrc 25 lrwxrwxrwx 1 root root 20 Oct 3 23:22 /root/.vimrc -> /home/xiaobai/.vimrc xiaobai@dnxb:/tmp$ ls -lathiL /root/.vimrc 12330229 -rw-r--r-- 1 xiaobai xiaobai 6.1K Oct 12 02:22 /root/.vimrc xiaobai@dnxb:/tmp$
But how about this file:
[xiaobai@localhost tmp]$ sudo find -L /bin \! -user root /bin/sp-sc-auth [xiaobai@localhost tmp]$ ls -lahi /bin/sp-sc-auth 1844640 lrwxrwxrwx. 1 root root 49 Aug 14 21:10 /bin/sp-sc-auth -> /home/xiaobai/note/src/sopcast/sp-auth/sp-sc-auth [xiaobai@localhost tmp]$ ls -lahiL /bin/sp-sc-auth 6164581 -rwxrwxr-x. 1 xiaobai xiaobai 839K Aug 14 21:09 /bin/sp-sc-auth [xiaobai@localhost tmp]$
sopcast-player without sudo/su, so should i worry about it ? Is it possible attacker take advantage of this kind of file which owned by normal user located in system $PATH but not executed directly by sudo/su ? And how about if gid is same group of normal user ?