From: "Florian G. Pflug" <fgp@...>
Date: 2001-09-27T08:29:59+09:00
Subject: [ruby-talk:21754] Re: Running ruby scripts suid-root

On Thu, Sep 27, 2001 at 05:52:47AM +0900, Rick wrote:
> the reason you can't do this is that when you run the script, that 
> #!/usr/local/bin/ruby at the beginning is telling your shell that what you
> want to run is 
> /usr/local/bin/ruby ruby-script
> so you would need to have ruby suid root, not the script.  And that would
> be pretty insecure.
> 
> Probably more info than you wanted, but the c wrapper seems like the way to
> go.
I know about the security implications. Since the pickaxe book talks about
the SAFE-level being different when running suid, I though ruby maybe has
some built-in support for suid scripts, like maybe:
	.) if the interpreter is suid, but the executed script is not, just drop
the root privileges before doing anything
	.) if the script is suid, but the interpreter is not warn about this
	.) if both are suid, execute the script suid, but take security
precautions (like a higher SAFE level)

I know perl has something called suidperl, but I don't know how this works.

anyway, I'll have to stick with some sort of wrapper....

greetings, Florian Pflug