readdir and checksecurity
one of our servers (which runs Debian Woody) was recently
compromised, and had a suckit variant installed. We've gone through the
reinstall and restore steps, and one of the things I looked at is
debian's /usr/sbin/checksecurity script, which checks for changes in
Now suckit alters the system call table to provide specific
functionality to the attacker; one of these is to make specified files
and directories invisible to readdir(3) through a hacked getdents(2)
My question is: doesn't this situation sort of invalidate
checksecurity's setuid check, since setuid files that are in "hidden"
directories won't show up in the listing?
Christian Robottom Reis | http://async.com.br/~kiko/ | [+55 16] 261 2331