PATH & chmod

Intimidator · 05-03-2005, 08:54 PM

hey

I have done the following way

Code:

 $ cp /usr/bin/talk  ~/bin/
 $ su -
 $ chmod 700 /usr/bin/talk
 $ logout
 $ export PATH=~/bin:$PATH
 $ talk

It worked.

=> It is possible for normal users to copy programs from other systems to their ~/bin/
directory.I mean the programs for which they don't have permission to execute in /usr/bin
/usr/local/bin

we can execute any program by this way

I came to know that the only way to stop this hack is to deny permission for normal users
to change the PATH environment variable

Any more suggestions for root??

btmiller · 05-03-2005, 10:13 PM

Yes, users can copy any executable they have read permission on to anywhere they have write permission. So they can copy binaries from other systems, which may or may not run depending on library versions etc. You can use a restricted shell (which does prevent changing the $PATH and forbids users for simply specifying the full path to commands) as one way around this. You could also confine users to a chroot jail missing many libraries (I do this on one system).

Intimidator · 05-03-2005, 10:30 PM

Thanks for that

http://www.justlinux.com/forum/showt...hreadid=139717

The above link gave me a partial solution..

any more suggestions ??

Matir · 05-04-2005, 12:33 AM

Or you could just make sure anywhere a user has write permission to is mounted noexec. (Done on my server). If you want a user to not be able to copy a binary, remove read permission. On a server at my school where we turn in programming assignments, the turnin program has rwx--x--x permissions... probably intended to keep students such as myself from running "strings" on it, disassembling it, etc. I have to see what strace would do... probably not work either. GDB won't.