setuid scripts

[Alan Barrett <apb%cequrux.com@localhost>]

On Sat, 14 Feb 2009, Aleksej Saushev wrote:
> > I think you can run setuid scripts if you build a custom kernel with
> > SETUIDSCRIPTS enabled.
> 
> Does it prevent symlink attack or simply disables the check?

AFAIK it works properly, by passing the script to the shell using an
open file descriptor, named via /dev/fd/${number}.  I have no idea why
it's disabled by default.

--apb (Alan Barrett)