SUMMARY: setuid doesn't recognize LD_LIBRARY_PATH

From: Eubank, Chris <ceubank_at_royalbcmuseum.bc.ca>
Date: Wed, 19 Dec 2001 09:20:16 -0800

OK so I must be one of the millions who have discovered this, and I received
answers honestly from all over the world. Impressive!!

The basic consensus was that it's a security hole, so you can't do that.

A workaround is to create a static binary. Another is to link with -rpath.

Thanks to Bob, Lucien, Joe, James, Chris, various sysadmins, Dr. Blinn,
David, Stan, and Allan!

Good thing I asked, otherwise I might have gone and broken my security !!

Chris

-----Original Message-----
From: Eubank, Chris
Sent: Tuesday, December 18, 2001 1:44 PM
To: 'tru64-unix-managers_at_ornl.gov'
Subject: setuid doesn't recognize LD_LIBRARY_PATH

Is there a way to specify trusted anything to allow a user to run a program
with the setuid bit enabled in a C program, rather than copying all the
necessary libraries to /usr/lib?

It seems it doesn't recognize the LD_LIBRARY_PATH variable.

Thanks
Received on Wed Dec 19 2001 - 17:22:14 NZDT

This archive was generated by hypermail 2.4.0 : Wed Nov 08 2023 - 11:53:43 NZDT