Re: Strange command histories in hacked shell history

Bill Vermillion wrote:

>
>Can anyone explain why  su   does not use the UID from the login
>instead of the EUID ?  It strikes me as a security hole, but I'm no
>security expert so explanations either way would be welcomed.
>
>Bill
>
>
>  
>
Because su does exactly what is says.  From the manual -

    DESCRIPTION

     *su* requests the password for /login/ and switches to that user and group ID
     after obtaining proper authentication.

Just for fun, here's an little snippet from the sudo manual -

  DESCRIPTION

*sudo* allows a permitted user to execute a /command/ as the superuser 
or another user, as specified in the /sudoers/ file. The real and 
effective uid and gid are set to match those of the target user as 
specified in the passwd file and the group vector is initialized based 
on blah blah blah...

-- 
---
----

http://www.ods.org

_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"