> On Mon, 11 Jan 1999 15:40:02 +0000 (GMT), alan@lxorguk.ukuu.org.uk
> (Alan Cox) said:
>
> >> In message <19990109215152.C32046@kitenet.net>, Joey Hess writes:
>
> >> GAK!!! Security flaw here, methinks. chown should unconditionally clear
> >> setuid and setgid.
>
> > Except when done by root
>
> Is there any consensus on this? According to singleunix, suid and
> sgid on regular files get cleared unconditionally except when the
> caller has "appropriate privileges", but in that case the behaviour is
> implementation-defined. What do other unixen do in this case?
In SunOS 5.5 and Digital Unix V4.0 the suid and sgid were not cleared if
root changed the file owner or group. But if non-root changes the file group
then both suid and sgid were cleared. I tried it with chown(1) and chgrp(1).
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/