Re: suid-perl

[Chip Salzenberg <chip@perlsupport.com>]

According to Jules Bean:
> On Sun, 31 Jan 1999, Chip Salzenberg wrote:
> > The code exists to check the mount options relevant to an open file.
> > It's just a Small Matter of Programming to integrate that into the
> > Perl source code, and disable emultation of setuid scripts when the
> > 'nosuid' mount option is set.
> 
> But, then every interpreter should do this [...] every suid-emulating
> interpreter.

(For those who don't know, suidperl is a setuid root binary that
securely *emulates* setuid scripts on operating systems that don't
support them directly.)

And yes, in theory, other suid-emulating interpreters ought to do the
same checks -- but AFAIK, there _are_ no others.

> Why hasn't linus patched the kernel so that suid scripts are secure?
> It's an easy task, surely?

"Beats the heck out of me, Batman."

> As it is, noexec is almost useless.  I can't help thinking that
> *all* interpreters *should* check noexec status.

What's the point?  Such files can be copied to /tmp and run there....
-- 
Chip Salzenberg      - a.k.a. -      <chip@perlsupport.com>
      "When do you work?"   "Whenever I'm not busy."