Very Computer

Hello,

Im having problems getting setuid to work on a bsdi 1.1 system
I have set the owner of a file as root and the "s" bit as
follows:

-rwsrwxr-x  1 root  wheel    1815 Nov  3 22:59 file.pl

If I try to run the program by sending email to an alias
in the sendmail /etc/aliases file ie. alias: "|/path_to_file/file.pl"
the program will not run as root but as daemon with effective and real id
of "1".

Can anyone suggest a way to get this working?

Thanks,
Phil

Hello,

Im having problems getting setuid to work on a bsdi 1.1 system
I have set the owner of a file as root and the "s" bit as
follows:

-rwsrwxr-x  1 root  wheel    1815 Nov  3 22:59 file.pl

If I try to run the program by sending email to an alias
in the sendmail /etc/aliases file ie. alias: "|/path_to_file/file.pl"
the program will not run as root but as daemon with effective and real id
of "1".

Can anyone suggest a way to get this working?

Thanks,
Phil

I have been able to get around this (sometimes) by writing a C wrapper.
The wrapper has the uid set (no uid set on the script), and then
it forks and exec's the script.  

In the exec, I generally do an:

execlp("/usr/bin/perl", "/usr/bin/perl", "/path/to/file.pl", NULL);

before that, create a pipe to the child process, and redirect the
stdin and stdout to it...

And make sure that the $ENV{"PATH"} has paths to any outside program
it needs to run in file.pl.

But to solve (maybe create more) problems better, try downloading
the Perl Compiler Kit by Malcom Beatle.

This will allow you to creat a stand-alone executable of your Perl
script which you can set uid bits without hassle ;)

Ian Fink

Jim.

I faced such a problem some time ago.
There is a complete solution.

First. Script must be setUID. (You do it)
Second. You must use not perl (#!/.../perl) but suidperl
        (or sperl4.036 on my PC) -- this is the trick.
Third. read man perl about suid scripts -- there is many stupid limitations:
        "Smart" sperl won't allow you to do "insecure" things (e.g. write to
        files).
Fourth. At www.perl.com (or something like this) there is a warning,
         that due to bug in suidperl, it's better clear suid flags (and
         disabling suid scripts)
Fifth. At last, I create an pseudo-account w/o shell, and set up cron to
         run my (non suid) script on this mailbox.

I think it will be enough...

Good luck.

P.S. if you find another solution, please, mail!

--
Regards, SerG.

Ian Fink

Quote:> Second. You must use not perl (#!/.../perl) but suidperl
>         (or sperl4.036 on my PC) -- this is the trick.

From Perl's config.h:

/* DOSUID
 *      This symbol, if defined, indicates that the C program should
 *      check the script that it is executing for setuid/setgid bits, and
 *      attempt to emulate setuid/setgid on systems that have disabled
 *      setuid #! scripts because the kernel can't do it securely.

You need the #!/usr/bin/suidperl trick if your version of Perl is not
compiled with this option.

Quote:> Third. read man perl about suid scripts -- there is many stupid limitations:
>         "Smart" sperl won't allow you to do "insecure" things (e.g. write to
>         files).

And, Perl prevents you from accidentally spawn a shell as part of a
system() call.  (That doesn't mean you couldn't use system() at all,
but you can't use it with arguments that require a shell.)

IMHO, all these measures make it much safer to write a setuid Perl
script than writing a setuid C program without all these safety belts.

Quote:> Fourth. At www.perl.com (or something like this) there is a warning,
>          that due to bug in suidperl, it's better clear suid flags (and
>          disabling suid scripts)

The best fix is to avoid ``Posix saved IDs'' for Perl.

To the best of my knowledge, a suidperl compiled with the following
settings on a 4.4BSD system can be considered secure:

/*#undef        HAS_SETEGID             /**/
/*#undef        HAS_SETEUID             /**/
#define  HAS_SETREGID            /**/
#define  HAS_SETREUID            /**/
#define  HAS_SETRGID             /**/
#define  HAS_SETRUID             /**/

--
J"org Wunsch                                              Unix support engineer

--
J"org Wunsch                                              Unix support engineer