Re: Adding a simple editor to the base system

[markucz%gmail.com@localhost]

> > I never tried it myself but my guess is [...]
> 
> I suppose actually looking to see what it does is out of the question?
I don't actually *need* setuid scripts, so I didn't waste time recompiling
the kernel only to see what it does. I just remember there was SETUIDSCRIPTS,
that's all.

> > How do you think the kernel could prevent symlink attacks?  I'm
> > curious to know.
> 
> By not passing a name attackers can symlink-replace, of course - such
> as by (see above) opening the script file in the kernel and passing the
> shell an fd already open onto it.
Yes, that's what options(4) says too. I didn't know there's FDSCRIPTS though.
Thank you for your explanation.