From: Brian Candler <b.candler@...>
Date: 2010-04-06T17:42:37+09:00
Subject: Re: $SAFE=0 for setuid?

Rick Ashton wrote:
> This means that by design the only way to use the pcap library is to log 
> in as root without escalating the current user's privileges? This 
> however isn't even possible in many linux distros like Ubuntu

sudo works fine in Ubuntu. Even if you run from the live CD, you can do 
"sudo bash" to get a root shell.

However, the reason for $SAFE=1 is that setuid *scripts* are very 
dangerous. If you want the full reasons, read
http://www.faqs.org/faqs/unix-faq/faq/part4/section-7.html
This talks about shell scripts, but the same issues apply to setuid ruby 
scripts.

Escalating to root properly, using su or sudo or even a setuid C wrapper 
program, makes some of the awkward problems disappear.

Of course, you still have the dangers of running a program as root which 
has to be very careful about validating all its inputs etc, but that's a 
separate and more obvious issue.
-- 
Posted via http://www.ruby-forum.com/.