On Fri 2015-05-01 18:23:20 -0400, Peter Stuge wrote: > Stephan Leemburg wrote: >> I did not find any clues when 'googling' and could not find any search >> options on the archives. > > Try harder: http://marc.info/?l=openssh-unix-dev This feels kind of rude. The OP has alreaday stated that he failed at searching, and folks on this list seem to know the answer and not give it to him. This is obviously a FAQ, so we should have a clear and concise writeup about why it is the way it is, maybe with pointers to other details if people want more depth. Here's a point from Jefferson Ogata: http://marc.info/?l=openssh-unix-dev&m=118591826828496&w=2 Here's another variant (slightly different) by Roman Fiedler: http://marc.info/?l=openssh-unix-dev&m=132983579918832&w=2 And another answer by Ángel_González: http://marc.info/?l=openssh-unix-dev&m=135984176826142&w=2 that last thread has further discussion from Damien Miller as well. The basic concern is that (someone correct me if i'm off-base here) when / is writable, pretty much any deliberate privilege-escalation mechanism (setuid binaries is the obvious example -- are there others?) is likely to be exploitable by whoever can write to /. This is because most tools designed to do limited privilege escalation limit how their increased capabilities can be invoked by some sort of check in the filesystem, whether that's a dynamically-linked binary starting up with a compromised ld-linux.so.2; a modified /etc/shadow, /etc/group, or /etc/fstab, or some other mechanism. Perhaps a brief writeup (feel free to start from the above paragraph if it's not horribly wrong) could be added to the FAQ so that we have someplace concrete to point people the next time this comes up? http://www.openssh.com/faq.html this seems at least as frequently-asked as question 2.4 - "Why does OpenSSH print: Dispatch protocol error: type 20" ;) Happy hacking, --dkg _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
