suid mystery
Cameron Simpson
cs at zip.com.au
Sat Dec 10 02:08:08 UTC 2011
On 09Dec2011 17:36, Dean S. Messing <deanm at sharplabs.com> wrote:
| I have a little suid mystery that perhaps someone would
| kindly help me solve. I just discovered that the files and
| symlinks in
| /usr/lib64/mozilla/plugins-wrapped
| get their "Modify time" updated each time I start firefox
| as me (not root). I just re-started firefox (at 17:19)
| and here is 'ls -l' of one of the files in the above dir:
|
| -rwxr-xr-x 1 root avdt 140440 Dec 9 17:19 nswrapper_64_64.libflashplayer.so*
|
| Now, I'm in group "avdt" so it is clearly "me" that
| updated (or first created) this file. Yet the above
| directory has these perms and ownership:
|
| drwxr-xr-x 2 root root
|
| Since neither the directory, nor the files have
| group write permission, it seems that firefox must be suid
| root in order to modify these files (if I understand
| correctly). But neither the shell script
| "/usr/bin/firefox", nor the executable that (I think) it
| calls "/usr/lib64/firefox/firefox" has the SUID bit (nor
| the SGID bit) set in its perms.
|
| So how can it update these files? I did not think that firefox could
| touch any of my "system" stuff.
It shouldn't be able to, IIUC.
How are you starting firefox? From the command line by running
/usr/bin/firefox? Even if not, it would be a useful test. Run that, see
if the timestamps change.
You can also do this:
strace -o str.out -e trace=file -f /usr/bin/firefox
Invoke firefox that way, watch the timestamps. When they change,
quit firefox and look at the str.out file to see if firefox is touching
this stuff.
Cheers,
--
Cameron Simpson <cs at zip.com.au> DoD#743
http://www.cskk.ezoshosting.com/cs/
Those who do not understand Unix are condemned to reinvent it, poorly.
- Henry Spencer @ U of Toronto Zoology, henry at zoo.toronto.edu
More information about the users
mailing list