From: bbense+comp.lang.ruby.Sep.12.02@...
Date: 2002-09-13T03:00:31+09:00
Subject: Re: RubyInline 1.0.4 Released! (fwd)

-----BEGIN PGP SIGNED MESSAGE-----

In article <667ED598F8A2D311981D00508B1223800E6C7168@emss02m04.ems.lmco.com>,
Henderson, Michael D <michael.d.henderson@lmco.com> wrote:
>Assume that the executable is in /home/foo/bar/boof and I have write
>permissions on /home/foo (either group or world).
>
>I can rename foo (eg, mv /home/foo /home/.foo) and create a new foo
>directory that I own and a /home/foo/bar directory, too.
>

- - That part I get. 


>Now I can selectively copy the items from bar on down back in to my new
>directory, changing those items that need it and setting
>permissions/owner/group as needed to fool you into thinking that nothing's
>wrong.

- - Are there unix OS's that still allow a regular user to chown
  files? 

>
>That's why a group writable home directory is bad. I can go in and create a
>.rhosts file that allows me to become you, and get you in trouble.
>

- - Yes, if your home dir is group writeable you have a lot more
  problems than trojan ruby-inline files.... But if say /home
  was group writeable, and I check ownership of the files I don't
  see how there is an attack unless the OS allows ordinary users
  to chown files. I know this was possible in older unix
  versions, but I don't know of any current unix OS's that allow
  this. I guess I should read what POSIX has to say about the
  matter. 

- - Booker C. Bense 


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBPYDSJ2TWTAjn5N/lAQFRSAQAoRl4mrmcybz1kD181Dk3+YbEXxmYBXkU
LLNwhaq95CqPFsU5pWpIgYd+k5RQax6/gZu31blvnfI9fue4xY1Bvsb4rBh6IFvj
Ni8PF0HI6cVwVUDXrQfIL2zPwPColt++LQaY+iJ9HZTadWGe4TrRXcPSDKBdpJPm
5Tgh8SF9ZuA=
=QmHH
-----END PGP SIGNATURE-----