I received a few more letters in regard to Didier Racheneurs article on SUID programs. We responded to the main points of objection in the July issue, so I wont cover those again. However, one reader pointed us to an interesting related item. See the following:
From: Magnus Bodin <email@example.com>
Subject: Setting Root SUIDed Programs at Work Build a Backdoor
A serious bug has been discovered in the Linux kernel that can be used by local users to gain root access. The problem, a vulnerability in the Linux kernel capability model, exists in kernel versions up to and including version 2.2.15. According to Alan Cox, a key member of the Linux developer community, It will affect programs that drop setuid state and rely on losing saved setuid, even those that check that the setuid call succeeded.
We appreciate all your letters. Keep writing! AA
I have to compliment you for what an excellent magazine Sys Admin is. I am a regular reader of the magazine, especially in regard to Elizabeth Zinkanns Books: A Users Report column.
I would like to offer a suggestion for her column, which Im also forwarding to her. I think it would be very helpful if a top ten book selection for specific topic areas was included on a monthly basis. This would be an extremely useful reference for myself, and Im sure many others when we are looking for high-quality books in our day to day jobs.
Again, thank you for producing such a useful magazine.
Thanks for the compliment. Were planning to post a Top Ten Books List on the Web site soon. AA
Subject: Sys Admin Feedback
From: Hans Drexler <firstname.lastname@example.org>
I read the article on BSD systems administration on your Web site. I think the author, Michael Lucas wrote an excellent article. The article uncovers the inner workings of the BSD booting process in a very understandable way. Still, it has much more in-depth covering of the subject than most other articles.
I was not even aware of the existence of your magazine previously. But keep publishing articles like this, with actual content in it, and you will have my undivided attention.
Thank you. Note that another article from Michael Lucas will appear next month in the September issue, entitled: FreeBSDs sysctl Interface. I hope youll enjoy it also. AA
Dear Sys Admin,
I just read and loved the article Building a Jumspstart Server for Solaris, by Peter van der Weerd in the Sys Admin May 2000 magazine. Since I am somewhat new to jumpstart on Solaris, I hope you can clarify something for me. On page 12 of the article, when editing the host_class file and explaining what it will do, Van der Weerd says it will load an entire distribution with the line cluster SUNWCuser. I believe it should be cluster SUNWCall and that was an error on someones part. Could you let me know if I am right or wrong on this point? Thank you very much.
Nick Patetta email@example.com
Oops ... youre absolutely right!
SUNWCuser is enduser distribution
SUNWCall is entire distribution
Sorry about that.