SUID permission on Bash script

[Michael David Crawford]

RW wrote:
> So are scripts actually incapable of running setuid?

They aren't on Linux.  I learned about that a while back when I 
investigated setuid scripts for a coworker.

It's not that setuid shell scripts are really more inherently insecure 
than programs written in C.  The problem is more that those who write 
such scripts tend not to observe the proper precautions.

For example if you don't set the PATH explicitly, and you don't give 
absolute pathnames to all the subprograms you run, then a trojan that 
has the same name as some standard program can get run as root.

If a program is going to be setuid at all, you really have to know what 
you're doing when you write it or else you'll find yourself opening a 
can of worms.

Mike
-- 
Michael David Crawford
mdc at prgmr.com

    prgmr.com - We Don't Assume You Are Stupid.

       Xen-Powered Virtual Private Servers: http://prgmr.com/xen