suidperl

hotshot has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: suidperl by arhuman (Vicar) on Dec 10, 2001 at 19:12 UTC
For security reasons, modern unices disable SUID bit on scripts. (Beccause it's often IMPOSSIBLE to have safe SUID shell script) `suidperl` allow you to use this suid feature even on such system... For a detailed explanation see : perlsec... Another (more general) safe way is the prog sudo "Only Bad Coders Code Badly In Perl" (OBC2BIP)	[reply] [d/l]
Re (tilly) 2: suidperl by tilly (Archbishop) on Dec 10, 2001 at 20:29 UTC
There have before been security problems in suidperl. And the sudo utility works just fine for me. Therefore given a choice, I always remove suidperl and use sudo instead.	[reply]
Re: suidperl by Erik Hensema (Sexton) on Dec 10, 2001 at 21:39 UTC
Your scripts should never start with `#!/usr/bin/suidperl -w` Allways just use /usr/bin/perl. suidperl is needed to be able to run scripts setuid. Usually this is impossible, because scripts are handled by an interpreter which isn't installed setuid. 'Running setuid' means that a program is started as if it was started by it's owner. So, if a file is owned by root:root and is setuid, it would be running with root priveliges regardless of what user started it. On startup, suidperl will change it's effective user-id to the id of the script's owner. Read man perlsec for more information. A script however is started with the permissions of the interpreter. So, if you make a script setuid it wouldn't have any effect. This is where suidperl comes in: suidperl is usually installed setuid root:root and is automatically invoked by perl when perls sees the scripts it's about to start is setuid.	[reply] [d/l]


Pathologically Eclectic Rubbish Lister
	PerlMonks