How to add su to /rescue ?
Guy Helmer
guy.helmer at gmail.com
Mon Jul 9 19:13:44 UTC 2018
> On Jul 9, 2018, at 6:54 AM, Julian H. Stacey <jhs at berklix.com> wrote:
>
> Hi current@
> I want to add su to /rescue, but got stuck on pam.
> Old unix su didn't suffer from pam.
> There's no #define in su to turn off pam.
> Man src.conf says WITHOUT_PAM is deprecated & does nothing.
>
> Can someone please offer a solution ?
> Or better to include a simple BSD su pre pam ?
> I would happily develop a patch for that.
Hi,
Aside from not being able to use pam from a static executable, please don’t try to make the crunched hard-linked executable in /rescue setuid-root (su is useless without it). That would mean anyone running /rescue/sh gets a root shell :-)
Conceptually, a separate crunchgen binary could be made for setuid-root purposes, but having a setuid-root binary in /rescue (outside of the normal hierarchy) makes me nervous.
Regards,
Guy
>
> Notes to explain the need, & patches from my
> http://berklix.com/~jhs/src/bsd/fixes/freebsd/src/gen/rescue/
> ---------
>
> Patch[es] below to solve this emailed scenario:
>> Please on prison-host cp /lib/libc.so.7 /tank/ezjail/my-domain/lib/libc.so.7
>> I am logged in on jail-host, but only as normal-user, not root, so I cannot run
>> /rescue/cp /usr/obj/usr/src/lib/libc/libc.so.7 /lib/libc.so.7
>>
>> a my make installworld on jail-host.my-domain previously failed with
>> ===> lib/libc (install)
>> install -C -o root -g wheel -m 444 libc.a /usr/lib
>> install -C -o root -g wheel -m 444 libc_p.a /usr/lib
>> install -s -o root -g wheel -m 444 -fschg -S libc.so.7 /lib
>> install: /lib/libc.so.7: chflags: Operation not permitted
>> *** Error code 71
>> (might or not be an artifact of being in a jail)
>>
>> unfortunately I had run the command as
>> xs make installworld
>> (xs is my own little root wrapper)
>> so when it exited, I was just normal-user not root, & I had forgotten to
>> open another xterm & leave it logged in as root,
>> & I found no /rescue/su
>
More information about the freebsd-current
mailing list