Re: SETUID perl script leaves backdoor open after dropping privileges

2012-04-25 Thread Ted Unangst
On Wed, Apr 25, 2012 at 07:15, Christopher Zimmermann wrote: As requested, here's the same test case a little more readable: This leaves a backdoor open (possibly in the saved UID): Yes, if you don't clear the saved uid, you can still switch back to it. You should use setresuid if it's

Re: SETUID perl script leaves backdoor open after dropping privileges

2012-04-24 Thread Christopher Zimmermann
As requested, here's the same test case a little more readable: This leaves a backdoor open (possibly in the saved UID): == #!/usr/bin/perl -wT use strict; use English qw(-no_match_vars); sub ids { print RUID=$REAL_USER_ID EUID=$EFFECTIVE_USER_ID\n } ids;