in reply to script permission
One problem is that if you run your scripts as root and they receive user input, then a clever user can submit special characters in his strings in order to execute arbitrary commands as root. One trick is to place a semicolon in the input which will indicate the end of a command. If you are submitting your user input as a string for execution using backticks then what comes after can be brand new executing commands that you did not write.
People more clever than I am are also able to induce an error condition using their input. The script can stop but it remains as root with the user logged in. A dangerous condition.
If you go this route try and use Perl's taint module. It warns you if you are executing user input or doing other no-no's.
|
---|