Re: setuid binary in ktsuss

From: Hubert Chathi <uhoreg(at)debian.org>
Date: Sat Feb 09 2008 - 18:06:28 EST

On Sat, 09 Feb 2008 14:13:30 -0800 Russ Allbery <rra@debian.org> wrote:

> Yves-Alexis Perez <corsac@debian.org> writes:
>
> > I'm about to upload ktsuss to debian, wich is a graphical wrapper
> > around su (much like gksu but without any gnome dependency). One
> > point puzzles me, the ktsuss binary is setuid root (so it can read
> > the root password). gksu doesn't do this (it calls su, I guess).
>
> I would expect it to use PAM, which uses the setuid unix_chkpwd

                                                      ^^^^^^^^^^^

As long as you're using pam_unix. It appears that if you use pam_unix2, you still need to be suid, since pam_unix2 doesn't have its own suid wrapper [1]. (I don't know what it's like with pam_pwdfile, etc.)

Now, whether pam_unix2 should use a wrapper or not is the subject of a different flamewar...

[1] http://bugs.debian.org/295526

    http://bugs.debian.org/362954

> binary. If it's not using PAM, that's probably a bug.
>

-- 
Hubert Chathi  -- Jabber: hubert@uhoreg.ca
PGP/GnuPG key: 1024D/124B61FA         
http://www.uhoreg.ca/
Fingerprint: 96C5 012F 5F74 A5F7 1FF7  5291 AF29 C719 124B 61FA


-- 
To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Received on Sat Feb 9 18:44:02 2008