[comp.sys.apollo] suid_exec

zrde05@master.trc.amoco.com (Ess) (09/28/90)

After receiving the patch from HP/Apollo for the suid_exec security problem,
one problem still comes to mind. (At least, to _my_ mind). What ever was
the purpose of this little jewel?

Robert Ess
zrde05@trc.amoco.com

dente@els.ee.man.ac.uk (Colin Dente) (09/28/90)

In article <2052@apctrc.UUCP> zrde05@master.trc.amoco.com (Ess) writes:
>After receiving the patch from HP/Apollo for the suid_exec security problem,
>one problem still comes to mind. (At least, to _my_ mind). What ever was
>the purpose of this little jewel?

suid_exec is (or should have been) the 'agent' that the Korn shell (ksh) uses
to execute s[ug]id scripts.  How the hell it was so badly cocked up as
to do what it did I'll never know... ;-(

Colin



--
  Colin Dente                     | JANET: dente@uk.ac.man.ee.els
  Manchester Computing Centre     | ARPA:  dente@els.ee.man.ac.uk 
  University of Manchester, UK    | UUCP:  ...!mcsun!ukc!manchester!dente 
                 ... I am the one you warned me of ...

fridman@cpsc.ucalgary.ca (fridman) (03/25/91)

In article <507faf9e.1bc5b@pisa.citi.umich.edu> rees@pisa.citi.umich.edu (Jim Rees) writes:

>>     This is a followup to a series of posting I made asking for help
>>     in getting BSD printing to run.  It is a summary of what I did to get 
>>     BSD printing running.
>
>   Why is this so hard?  And why isn't it in the Apollo documentation?
>
>   I've added this writeup to the FAQ file, which has moved from
>   dabo.ifs.umich.edu to dabo.citi.umich.edu (same machine, same address,
>   different name).

It's not difficult, but simply not documented.  

For example, where does it say how to properly send jobs to a PostScript printer?  

Where does it mention that you can't set XON/XOFF using stty?  

Chapter 6 of Managing BSD Software tells you to put all your hosts in hosts.equiv.
Why? Having a .rhosts file for daemon works better and provides more securiy.
Also this same chaper says nothing of hosts.lpd but is does mention the useless
/usr/spool/lpd/servername.

and  so on, and so on, and so on.....

As far as "why isn't it in the Apollo documentation", ?.

	RF.