Re: Interesting suid problem

[Owen Taylor <otaylor redhat com>]

Valdis Kletnieks vt edu writes:

> On Thu, 21 Feb 2002 22:30:54 +0100, Vincent Arkesteijn <v j arkesteijn utwente nl>  said:
> 
> > Why? Just put the password in the program, and give your users
> > execute permission, but no read permission on the program. It
> > may not be too elegant, and it's a bit clumsy when you want to
> > change the password, but it's the simplest solution.
> 
> Still vulnerable to attack via gdb/dbx or ptrace(), but that's a
> question of whether your threat model includes somebody both that
> determined and skilled...

You can't gdb/ptrace a non-readable executable on most operating systems.

Regards,
                                        Owen