Original query:
>I am writing a simple program with a GUI that will let normal users start
>and stop printers. It is just a wrapper for 'lpc' that runs setuid root.
>When the program starts, it checks that the effective user ID is root
>with geteuid(). That works OK, but when it calls lpc with the 'system'
>command, lpc rejects the call with the message "?Privileged command", i.e.
>lpc isn't being called by root.
I was misled by the S&NA manual, "The operating system uses the effective
user and group IDs to determine access permissions for the process. The
real user and group IDs are used for accounting purposes.", and so forth,
also by how su is "effectively" root (who am i), but still knows my user name.
lpc wants the REAL user ID also set to root, then it works. lpc still
complains, however, by returning an error 2 when it is called like this.
Thanks to:
blymn@awadi.com.AU (Brett Lymn): he warned strongly of problems with the
'system()' call in applications like this:
>Never never never never use the system call in a setuid root program.
>The rotten thing is *sooooo* easy to subvert you would not believe.
>Use fork and exec to run your command.
morrow@cns.ucalgary.ca (Bill Morrow)
Mike Raffety <mike_raffety@il.us.swissbank.com>
Widar Karlsen <widar@enas.oslonett.no>
Neil Rickert <rickert@cs.niu.edu>
colijn@eps.agfa.be (Luc Colijn)
solie_bryan@jpmorgan.com
Peter Allott <peter@essex.ac.uk>
djd@rs.com (Dan Dasaro)
"Henry Katz" <hkatz@lehman.com>, who suggests using sudo
jsoares@porthos.inescn.pt (Joaquim Fernando Soares)
Dan Stromberg - OAC-DCS <strombrg@bingy.acs.uci.edu>
glenn@uniq.com.au (Glenn Satchell)
pod@morgan.com (Paul O'Donnell)
Gregory Bond <gnb@melba.bby.com.au>
William Charles <william@wet.sbi.com>
----------------------------------------------------------------------------
\ ..\ /../ Howard Schultens Tel: ++49 551 39 5914
\.o.\ /../ Zentrum Physiologie FAX: ++49 551 39 5923
\o.o> /: / Abteilung Neuro- und
\o/ / \ Sinnesphysiologie
Y R .oo \ Humboldtallee 23
/ o o.o \ D-37073 Goettingen
<_*o*_*.*_> Germany E-Mail: hs@demeter.ukps.gwdg.de
--===r=R=r=Rr===------------------------------------------------------------
This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:09:09 CDT