On Sat 10Dec11 13:08 +1100 Cameron Simpson wrote: > On 09Dec2011 17:36, Dean S. Messing <deanm@xxxxxxxxxxxxx> wrote: > | I have a little suid mystery that perhaps someone would > | kindly help me solve. I just discovered that the files and > | symlinks in > | /usr/lib64/mozilla/plugins-wrapped > | get their "Modify time" updated each time I start firefox > | as me (not root). I just re-started firefox (at 17:19) > | and here is 'ls -l' of one of the files in the above dir: > | > | -rwxr-xr-x 1 root avdt 140440 Dec 9 17:19 nswrapper_64_64.libflashplayer.so* > | > | Now, I'm in group "avdt" so it is clearly "me" that > | updated (or first created) this file. Yet the above > | directory has these perms and ownership: > | > | drwxr-xr-x 2 root root > | > | Since neither the directory, nor the files have > | group write permission, it seems that firefox must be suid > | root in order to modify these files (if I understand > | correctly). But neither the shell script > | "/usr/bin/firefox", nor the executable that (I think) it > | calls "/usr/lib64/firefox/firefox" has the SUID bit (nor > | the SGID bit) set in its perms. > | > | So how can it update these files? I did not think that firefox could > | touch any of my "system" stuff. > > It shouldn't be able to, IIUC. Thanks for the confirmation. > How are you starting firefox? From the command line by running > /usr/bin/firefox? Even if not, it would be a useful test. Run that, see > if the timestamps change. I normally let KDE start it. When I kill KDE from "the last time" it was up, so KDE just restarts it. Otherise I manually start it from the firefox icon in the panel. I just tested your suggestion. The timestamps are changing. > > You can also do this: > > strace -o str.out -e trace=file -f /usr/bin/firefox > > Invoke firefox that way, watch the timestamps. When they change, > quit firefox and look at the str.out file to see if firefox is touching > this stuff. Will try this and report back later. Must run now. Thanks very much for your help! Dean -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
