ochrana proti hackerum...

[Matus fantomas Uhlar]

Radovan Garabik <garabik na center.fmph.uniba.sk.spam> wrote:
->  : Bez chfn si dovedu zivot take predstavit. Zajimala by me jina vec. Shazuji
->  : SUID na xtermu, ale kompenzuji to obvykle tim, ze povoluji zapis do utmp i
->  : userum. Predpokladam, ze je to lepsi nez SUID xterm, nebo je nekdo jineho
->  : nazoru?

-> nuz, suid xterm je potencialne riziko preniknutia do systemu (ale iba ak
-> sa v xterme objavi nejaka diera - co je celkom mozne) 
-> Povoleny zapis do utmp je priam vyzva na to aby (zli) uzivatelia tam 
-> robili chaos... da sa tym narobit pekny zmatok.
-> Napadlo ma ze by to islo vyriesit utvorenim groupy (povedzme) utmp, dat
-> suboru utmp pravo na zapis pre tuto groupu a urobit xterm setgid...

SESSREG(1)                                             SESSREG(1)

NAME
       sessreg - manage utmp/wtmp entries for non-init clients

SYNOPSIS
       sessreg  [-w  wtmp-file] [-u utmp-file] [-l line-name] [-h
       host-name] [-s slot-number] [-x Xservers-file]  [-t  ttys-
       file] [-a] [-d] user-name

-- 
 Matus "fantomas" Uhlar, sysadmin at Telenor Internet Kosice, Slovakia
 BIC coord for *.sk; admin of netlab.irc.sk; co-admin of irc.felk.cvut.cz
 Micro$oft random number generator: 0, 0, 0, 4.33e+67, 0, 0, 0...