Re: Proposal of new group

[Tomasz Wegrzanowski <maniek@beer.com>]

> > I see some possibilities to make a mess with suid shutdown but not
> > much more mess than with turning power off by button
> > but if you know any exploits of suid shutdown of which I dont know
> > please tell me (Ive found nothing in manpages)
> 
> Well it would be a bit weird if root-exploits were described in manpages
> wouldn't it ;)

I talked about making a mess with shutdown not root-exploits.
Such topics can be often found in manpages

> But the source might contain a buffer overflow exploit, or another
> exploit. Yes, I wrote the code myself, and there is even a comment
> in the code about running setuid in a special group. But in my experience
> _every_ setuid program has at least one hole, no matter how careful
> you are. Avoiding setuid programs (esp. setuid root) is important.

shutdown accepts no user input as far i know so how user can do
buffer overflow?
Simple enough suid programs doesnt have always holes.
And shutdown will more possibly shut computer down with making a mess
when something will go wrong.

> If you still consider doing this, at least 2 different experienced
> people should audit the program you want to make setuid (shutdown)
> to see if there are no security problems involved.

Come here and find them. I live in a deep province where nearly every computer has
windoze inside so the most experienced users i can find are on this list.