On Tue, Nov 27, 2001 at 05:16:30PM +0100, Praise wrote:
Is /tmp a danger if it can contains executables?? Note: I have to allow executables from users' home dir.
Not really, since a hacker can run any file (or binary) even when it hasn't any executable-attribute set (ofcourse, the hacker should still have the permission to read the file). ~$ ls -l somefile -rw-r--r-- 1 nitro nitro 14011 Nov 27 17:35 somefile ~$ id uid=512(tus) gid=505(lusers) groups=505(lusers),10(wheel),21(slocate) ~$ file somefile somefile: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), not stripped ~$ ./somefile bash: ./somefile: Permission denied ~$ /lib/ld-linux.so.2 ./somefile Hello world! ~$ -- Unix, MS-DOS and Windows NT (also known as the Good, the Bad and the Ugly). ~(Matt Welsh)