Shell Programming and Scripting

hi
I am moving old files by using the following script :

find /home/-type f -atime +10 | \
while read file
do
mv $file /tmp/old
done

The script must also track the size of the directory it is creating and stop and create a
new directory when the size is some value (e.g. the size of a CD-ROM - 50MB (to allow for the
directories)) and size limit can be easily changed.
How can I do that?

?????

What if I would tell you that if you run that script with root and you allow other users on your machine they could move ANY file on your machine to /tmp/old ?

Let me demonstrate.

Code:

$ mkdir -p "unix/ ../etc/"
$ touch "unix/ ../etc/passwd"

Then your script...

Code:

# find . -type f | while read file; do echo mv $file /tmp/old; done
mv ./unix/ ../etc/passwd /tmp/old
#

As you can see, I was able to mv ../etc/passwd to /tmp/old. Now an attacker could use ".." or "." or even nothing depending on which directory the script was executed.

As to your question, use du to see the size of the directory and please be careful with your scripts.

Someone please advise on possible simple workarounds for this issue.

this is mine:

Code:

find . -type f | while read file; do echo mv \"$file\" /tmp/old; done

Code:

 du -sk /tmp.old | read blocks dummy && print $(( blocks * 1024 ))

gives the total in bytes

What redoutable is saying -
Running as root you could have your /etc/passwd file or the shadow file
wind up in a publically readable directory. Then a simple dictionary attack, which might take some time, would give the bad guys access to everything on your machine.

FWIW - an attacker would have to be able to see what you are doing to exploit it. But.
Your best bet is not to move files around willy-nilly when you are a privileged user, unless you are sure about what file you are moving where.

And I don't know a simple workaround. Other than creating a non-priv user with multiple group membership - then newgrp to the correct group to play with the files. Someone else does know a good one, I'm sure.

thank jim
When I run your script it says:
Can`t file file 0

Mcnamara a simple workaround is just to use ' " ' in the $file variable.

The actual problem here is that an attacker could trick the script into parsing three (old file and injected path and /tmp/old) or more parameters to "mv" instead of the disered two (old file and /tmp/old). That could be done simply by adding a space to a file name thus braking the $file variable into two arguments to "mv" instead of one.

Wrong vulnerable script with three arguments:

Code:

 mv file ../etc/shadow /tmp/old

Ok script with two arguments:

Code:

mv "file ../etc/shadow" /tmp/old

This is actually more serious than it looks because the error is generally done with "rm -rf" instead of "mv" (in cron entries) and enables attackers to wreck beyond all repair any system by removing/moving critical files. Furthermore the system administrator would never be able to detect why the system is losing those critical files because the error is very subtle and lots of money would be spent restoring those machines.