Hi Elaine
Thanks for the info. After spending loads of time searching the web I
decided to send an email to this group. As usual I found the answer about
an hour later. Basically the suggestion in the perl security stuff of
writing just a .c wrapper with an exec statement doesn't work, or at least
in my case. I also added in a setuid and seteuid statement and then it
worked.
I don't really like setuid programs but as it will not be running as root
their is not too much chance of it causing problems. The cgi-bin that I
will be running this from is on a sys-admin intranet. The web server runs
as user nobody. I did not set this up and so I am not keen on changing it.
And even it was changed to another user it would make little difference to
my suid problem unless I ran it as the squid user which I would think is
even less secure as it opens up all the squid processes and not just the
redirector children. The perl script is quit specific as to what it is
killing and does not take parameters.
I have been an SA and DBA for 7 years and have worked in a lot of different
environments for several companies and I didn't go into apoplectic shock at
my suggestion :-)
Thanks again for the advice.
Jeff.
Elaine -HFB-
Ashton To: Jeff Rouse/NCO/CEtv
<[EMAIL PROTECTED]>
<elaine@chaos. cc: [EMAIL PROTECTED]
wustl.edu> Subject: Re: Executing the kill command
from within an suid script.
08/07/2001
12:07 AM
Jeff Rouse/NCO/CEtv [[EMAIL PROTECTED]] quoth:
*>
*>Basically the process I wish to send a kill signal to is a redirector for
*>squid. The process is owned by the squid user. The kill signal makes
the
*>redirector dump statistics about itself to a file. I want to run a
script
*>from my cgi-bin which will run as user nobody that can send the kill
signal
*>to the process that squid owns. The script works fine when run as root.
Sometimes things don't work for good reason. Having a process owned by
'nobody' able to kill a real user process? An SA would go into apoplectic
shock right about now...oh, and from the web too...gads, call the
paramedics.
The feature known as 'suidperl' is what you are looking for most likely.
Also, your system may have suid restrictions such as -nosuid with
automount or NFS on some of the filesystems, etc.
There have been a couple of CERT advisories in the last few years on the
dangers of using suidperl and suid in general is a less than stellar idea
for anything, unless you are aware of the risks involved.
*>Does anyone know how I can get my perl script to run as another user and
*>issue a kill signal to a process?
http://perldoc.cpan.org/ and read the perlsec pod
Also, "Web Security" by Lincoln Stein, ISBN: 0201634899, may be a good
introduction for you. He also maintains the WWW Security FAQ that has a
load of good info http://www.w3.org/Security/Faq/index.html#contents.
Don't run suid if you don't have to-ever. Ask yourself why nobody needs
to kill real system user processes and perhaps either redesign or try
something else. Usually it's a matter of being lazy and lazy doesn't win
when you want a reasonably secure system.
e.
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
=========================================================
This message has been scanned for viruses by AUSTAR Communication's
antivirus and content checking applications.
Austar Communications
=========================================================
***************************************************************************************************************************************************************************
This email and any files transmitted with it, are confidential and is intended solely
for the use of the individual or entity to whom they are addressed.
If you have received this email in error, please notify the system manager.
This footnote also confirms that this email message has been scanned by AUSTAR
Communications content and virus scanning applications
for the presence of computer viruses.
***************************************************************************************************************************************************************************
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
