From: David Masover <ninja@...>
Date: 2010-05-29T15:13:33+09:00
Subject: Re: Insecure operation - chdir

On Friday, May 28, 2010 04:17:35 pm Yang Zhang wrote:
> To add to the confusion, the rake task runs fine from root's crontab.
> I found some information on taint and $SAFE, but it's unclear to me
> why things work via cron but not via a suid binary.

Well, if the purpose of these things being enabled on setuid is to make it 
harder for a user to exploit a poorly-written Ruby script to gain root access, 
it makes perfect sense. If the task is in root's crontab, only root can run 
it, or do anything to screw with the environment it's being run from. If it's 
run setuid, any user on the system can run it whenever and however they want.