Sponsored Content
Operating Systems AIX Why /bin/su permission with SUID? Post 302910427 by Corona688 on Thursday 24th of July 2014 11:36:00 AM
Old 07-24-2014
Permit me to be quite extremely blunt. Your auditor is an idiot. He has heard that "SUID is bad" and parroted it, but has no real understanding of it. Following his advice will ruin your machine.

su couldn't possibly work if it weren't SUID. It needs to access the shadow files, which are locked to root!

Now, if there are things which are set SUID but shouldn't be, that would be bad. Having cp set SUID would be a recipe for disaster for example.
These 3 Users Gave Thanks to Corona688 For This Post:
 

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

/bin/sh: bad interpreter: Permission denied

today i started the LFS book (version 4.0). Basically i am using slackware 9.0 to try and install a new linux completely from source on another partition. Now i took the book's recommendations and created a user called lfs so i wouldn't have to do the stuff as root, and i have got the new LFS... (4 Replies)
Discussion started by: Calum
4 Replies

2. UNIX for Dummies Questions & Answers

fuser: difference with bin/sh and bin/ksh shell script

Hi, I have a problem I don't understand with fuser. I launch a simple shell script mysleep.sh: I launch the command fuser -fu mysleep.sh but fuser doesn't return anything excepted: mysleep: Then I modify my script switching from #!/bin/sh to #!/bin/ksh I launch the command fuser -fu... (4 Replies)
Discussion started by: Peuj
4 Replies

3. Solaris

/usr/bin has been changed with 777 permission

Hello Guruz, Relay bad condition :mad: Some has changed the permission to 777 recursively for /usr/bin directory by mistake. Now all the permission looks to be 777 on /usr/bin Hence I am so many system related errors as 1 show below. When I am trying to change the password, I am getting... (5 Replies)
Discussion started by: bullz26
5 Replies

4. OS X (Apple)

I accidentally changed to only write permission on /usr/bin... please Help!

I accidentally changed to sudo chmod a=w to my /usr/bin folder on my macbook with OS 10.5.8... Please help! I can't even get into a terminal correctly cause it displays: -bash: uname: command not found -bash: cut: command not found -bash: uname: command not found -bash: cut: command not found... (6 Replies)
Discussion started by: scaryMac23
6 Replies

5. Red Hat

/bin strange permission, corrupted? [solved]

Hi I think my /bin is corrupted which is why I can’t boot my server.. Anyone knows what below file permission means? # ls -l /mnt/sysimage | grep bin drwxr-xr-x 2 root root 12288 Sep 29 11:23 sbin ?r--rw-x 41112 16694 1305152 0 Feb 10 2055 bin Tried overwriting, deleting,chmod,chown but... (0 Replies)
Discussion started by: halacil
0 Replies

6. OS X (Apple)

When to use /Users/m/bin instead of /usr/local/bin (& whats the diff?)?

Q1. I understand that /usr/local/bin means I can install/uninstall stuff in here and have any chance of messing up my original system files or effecting any other users. I created this directory myself. But what about the directory I didn't create, namely /Users/m/bin? How is that directory... (1 Reply)
Discussion started by: michellepace
1 Replies

7. Shell Programming and Scripting

[Solved] Retrieve all the permission of the /bin folder

hello friends, By mistake I have run find / -type f -exec chmod 644 {} \; now all permission has been chaged of /bin I am not able to change the permission. I am working on the virtuozzo VPS. Is their any way to retrieve the permission to 770 to /bin Note /bin/chmod also not executing... (2 Replies)
Discussion started by: sharlin
2 Replies

8. AIX

Redistribution bin required for AIX. j7r164redist.7.1.0.25.bin

Hi, I am planning to install a version of Informatica on my AIX box. It requires a specific java build in pap6470_27sr2-20141101_01(SR2). The current link for IBM 64-bit SDK for AIX®, JavaTM Technology Edition, Version 7 Release 1 has a more recent version in j7r164redist.7.1.0.75.bin. Is... (4 Replies)
Discussion started by: meetpraveens
4 Replies

9. UNIX for Dummies Questions & Answers

Difference between inbuilt suid programs and user defined root suid programs under bash shell?

Hey guys, Suppose i run passwd via bash shell. It is a suid program, which temporarily runs as root(owner) and modifies the user entries. However, when i write a C file and give 4755 permission and root ownership to the 'a.out' file , it doesn't run as root in bash shell. I verified this by... (2 Replies)
Discussion started by: syncmaster
2 Replies

10. Shell Programming and Scripting

Usage of #!/bin/sh vs #!/bin/bash shell scripts?

Some question about the usage of shell scripts: 1.) Are the commands of the base shell scripts a subset of bash commands? 2.) Assume I got a long, long script WITHOUT the first line. How can I find out if the script was originally designed für "sh" or "bash"? 3.) How can I check a given... (3 Replies)
Discussion started by: pstein
3 Replies
CHFN(1) 							   User Commands							   CHFN(1)

NAME
chfn - change real user name and information SYNOPSIS
chfn [options] [LOGIN] DESCRIPTION
The chfn command changes user fullname, office room number, office phone number, and home phone number information for a user's account. This information is typically printed by finger(1) and similar programs. A normal user may only change the fields for her own account, subject to the restrictions in /etc/login.defs. (The default configuration is to prevent users from changing their fullname.) The superuser may change any field for any account. Additionally, only the superuser may use the -o option to change the undefined portions of the GECOS field. These fields must not contain any colons. Except for the other field, they should not contain any comma or equal sign. It is also recommended to avoid non-US-ASCII characters, but this is only enforced for the phone numbers. The other field is used to store accounting information used by other applications. OPTIONS
The options which apply to the chfn command are: -f, --full-name FULL_NAME Change the user's full name. -h, --home-phone HOME_PHONE Change the user's home phone number. -o, --other OTHER Change the user's other GECOS information. This field is used to store accounting information used by other applications, and can be changed only by a superuser. -r, --room ROOM_NUMBER Change the user's room number. -R, --root CHROOT_DIR Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory. -u, --help Display help message and exit. -w, --work-phone WORK_PHONE Change the user's office phone number. If none of the options are selected, chfn operates in an interactive fashion, prompting the user with the current values for all of the fields. Enter the new value to change the field, or leave the line blank to use the current value. The current value is displayed between a pair of [ ] marks. Without options, chfn prompts for the current user account. CONFIGURATION
The following configuration variables in /etc/login.defs change the behavior of this tool: CHFN_RESTRICT (string) This parameter specifies which values in the gecos field of the /etc/passwd file may be changed by regular users using the chfn program. It can be any combination of letters f, r, w, h, for Full name, Room number, Work phone, and Home phone, respectively. For backward compatibility, yes is equivalent to rwh and no is equivalent to frwh. If not specified, only the superuser can make any changes. The most restrictive setting is better achieved by not installing chfn SUID. FILES
/etc/login.defs Shadow password suite configuration. /etc/passwd User account information. SEE ALSO
chsh(1), login.defs(5), passwd(5). shadow-utils 4.5 01/25/2018 CHFN(1)
All times are GMT -4. The time now is 08:29 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy