kodo has asked for the wisdom of the Perl Monks concerning the following question:

Hello monks,
I've got the following script running in SUID-mode => taint-mode and I get the following msg when trying to start it: Insecure dependency in connect while running setuid at /usr/local/lib/perl5/5.6.1/386/AT-svr4/IO/Socket.pm line 108.

I don't really need it 100% secure because all incoming data is from me and I'm the only one using it.
Is it possible to turn off taint-mode for SUID-Scripts? But it would be much more nice to know WHY it doesn't work, so here's the code:


#!/usr/local/bin/perl -w use strict; use Net::FTP; use Net::Ping; my $serverfile = '/home/someuser/etc/checkftp/servers'; my @serverfile = (); open(FILE, "< $serverfile") || die "Couldn't open $serverfile: $!"; @serverfile = <FILE>; close(FILE); foreach(@serverfile) { chomp; my ($type, $host, $user, $pw) = split(/:/, $_); if ($type eq "ftp") { &ftpcheck($host,$user,$pw); } elsif ($type eq "ping") { &pingcheck($host); } else { print "Unknown Check: $type\n"; } } sub ftpcheck { my $ftperror = 0; my ($host, $user, $pw) = @_; my $ftp = Net::FTP->new("$host", Timeout => 6, Debug => 0) || eval { print "FTP-CHECK:\t[$host]\t\t=>\tCouldn't connect: $!\n" +; ++$ftperror; }; return; if ($ftperror eq "0") { $ftp->login($user, $pw) || eval { print "FTP-CHECK:\t[$host]\t\t=>\tCouldn't login: $!\n +"; ++$ftperror; }; } if ($ftperror eq "0") { $ftp->quit || eval { print "FTP-CHECK:\t[$host]\t\t=>\tCouldn't quit: $!\n" +; ++$ftperror; }; } if ($ftperror eq "0") { print "FTP-CHECK:\t[$host]\t\t=>\tOK.\n"; } $ftp->quit(); } sub pingcheck { my $pingerror = 0; my $host = $_[0]; my $ping = Net::Ping->new("icmp"); $ping->ping($host) || eval { print "PING-CHECK:\t[$host]\t\t=>\tCouldn't ping: $!\n"; +++$pingerror; }; if ($pingerror eq "0") { print "PING-CHECK:\t[$host]\t\t=>\tOK.\n"; } $ping->close(); }

Edit kudra, 2002-04-24 Added a readmore tag

Replies are listed 'Best First'.
Re: SUID-Taint-Problem?!
by shotgunefx (Parson) on Apr 24, 2002 at 10:21 UTC
    I'm guessing one of the following variables my ($type, $host, $user, $pw) is making it to a system call. To use them, you will need to untaint them using a regex and capturing parenthesis.
    $type = $1 if $type =~ /^(ftp|ping)$/; # others follow


    -Lee

    "To be civilized is to deny one's nature."
    Update Fixed error. Thanks for the dope slap crazyinsomniac :P
      Okay thanks all, the problem is solved now. The error was that I didn't untaint $host, I got ($host) = $host =~ /^(.*)$/; now and everything works fine.


      -----BEGIN PERL GEEK CODE BLOCK----- Version: 0.01 P++>+++$c-> P6 >+R+>+M+>++O >+MA+>+++E+>++PU+>+++BD C+>++D!S X!WP >+++MO?PP++n CO?PO-o+G A--OL!Ee---Ev++Eon!Eot!Eob!Eoa!uL++uB uS!uH+uo+w---m!osA-osBE- ------END PERL GEEK CODE BLOCK------
      Hi Shotgunefx,
      tried it but didn't help. Also I know what's in the servers-file -> what could do a syscall and there's nothing like that in it..
      I really don't understand the reason for this one...trying for hours now :(

      thanks anyway,

      giant
        Did you untaint the other variables I mentioned? If so, try using hard coded values in there and see what happens.

        Also, on NIX boxes, I believe that usually only root can use ICMP.

        You should also set the $ENV{PATH} as I mentioned in the chatterbox.

        -Lee

        "To be civilized is to deny one's nature."