On Dec 21, 2007 1:27 PM, C. Scott Ananian <[EMAIL PROTECTED]> wrote: > I think people misunderstand the core problem: if root does not have a > password, then *any activity on the system* can gain root privileges > by su'ing to root.
This is not a given. Much has to be in place for this to happen. Off the top of my head... 1. the "su" binary must be in the namespace 2. the "su" binary must not be overmounted 3. the "su" binary must be on a suid filesystem 4. the "su" binary must be setuid root 5. the "su" binary permission must allow execution 6. /etc/pam.d/su must not have pam_wheel.so set up 7. no SE Linux restrictions block required transitions Pay attention to number 7. Look here: -bash-3.2# cat /etc/pam.d/su #%PAM-1.0 auth sufficient pam_rootok.so # Uncomment the following line to implicitly trust users in the "wheel" group. #auth sufficient pam_wheel.so trust use_uid # Uncomment the following line to require a user to be in the "wheel" group. #auth required pam_wheel.so use_uid auth include system-auth account sufficient pam_succeed_if.so uid = 0 use_uid quiet account include system-auth password include system-auth session include system-auth session optional pam_xauth.so -bash-3.2# So it looks like you just uncomment line 6 in that file, add user "olpc" to the "wheel" group, and verify that nothing is copying supplementary groups to activities. (hey, I saved one byte!) _______________________________________________ Devel mailing list Devel@lists.laptop.org http://lists.laptop.org/listinfo/devel