jp.guillemin at free.fr
Sat Jun 30 12:52:50 CEST 2007
Tim Tassonis wrote:
> Hi Auke
>> that should not be the case... a login manager should run *as* root but
>> certainly not be setuid root.
> Of course, you are right. But it doesn't really matter. The point is
> that a user sits in front of a program that runs as root, but the user
> is not root. That results in the same implications as a setuid program.
Not really :
- A suid program can be launched by Bill and will run as if Bill was root.
- A 754 root:root program can only be started by root. It makes a big
If the suid program has an exploitable buffer overflow problem : anybody
getting unprivileged access to the computer can launch the suid program
with appropriate shell code, and then he's root.
A program that can only be started by root is useless for somebody that
... **wants** to be root ;)
More information about the Xfce4-dev