[vox-tech] Running a suid root perl script

[Henry House]

--x+6KMIRAuhnl3hBn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, May 03, 2003 at 08:08:45AM -0700, Ken Herron wrote:
> --On Saturday, May 03, 2003 07:34:01 AM -0700 Henry House=20
> <hajhouse@houseag.com> wrote:
>=20
> >I created suid.pl as
> >
> >	#!/usr/bin/sperl5.8.0 -T
> >	print $ENV{"USER"}."\n";
>=20
> USER is just a string in the process's environment. It isn't=20
> automatically updated when you run a setuid program. Try having the perl=
=20
> script print its real and effective UIDs, or create a file and see what=
=20
> ID owns it.

You're right. The file is owned by root. Now the real reason that I want an
suid script:

#!/usr/bin/suidperl -T
$ENV{'PATH'} =3D '/bin:/usr/bin';
delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
$ENV{'HOME'} =3D '/root';
open(BOGOFILTER, "|ssh root\@mail.internal bogofilter -Nsv");
while ($line =3D <STDIN>) { print BOGOFILTER $line }
close(BOGOFILTER);
exit

This script, residing at /usr/local/bin/spamlearn, is intended to allow
al users to redirect spam that gets through back to the bogofilter* database
on the mail server, a seperate machine that normally does not host
interactive logins. SSH is configured to accept key-based auth only and the
key is in root's home. But it does not work: SSH asks for a password and
warns about an unknown server fingerprint, indicating that it is using
the user's ~/.ssh not /root/.ssh. Any ideas?

* Baysian classifier capable of recognizing known spam types with 99%
  accuracy. It is integrated into exim on my mail server.

--=20
Henry House
The attached file is a digital signature. See <http://romana.hajhouse.org/p=
gp>
for information.  My OpenPGP key: <http://romana.hajhouse.org/hajhouse.asc>.

--x+6KMIRAuhnl3hBn
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+tq9gi3lu92AVGcIRAkIRAJ94pAgRrtcDVSqm+rzjZwNUix9EAwCggAQf
Ed5XDRZQJuyShdaksEkhwSs=
=dukD
-----END PGP SIGNATURE-----

--x+6KMIRAuhnl3hBn--