search

ZOSOpenTools / sudoport

Sudo
Apache License 2.0
1 stars 0 forks source link

sbin directory and executables #6

Open gngrossi opened 1 year ago

gngrossi commented 1 year ago

From a security perspective, is it feasible to remove "other (world)" access to the directory and its executables? thanks

IgorTodorovskiIBM commented 1 year ago

Checking Linux:

 ls -l /sbin/visudo
-rwxr-xr-x 1 root root 225064 Apr  3 11:00 /sbin/visudo

What are the permissions on the IBM ported sudo 1.7 sbin executables/directory?

gngrossi commented 1 year ago

[@02858@SYSB]$ ls -lE /usr/lpp/ported/bin/base ---s--x--x -p-- 3 BPXROOT @ISZOST1 581632 Apr 3 2012 sudo-1.7.2p2 ---s--x--x -p-- 3 BPXROOT @ISZOST1 581632 Apr 3 2012 sudoedit-1.7.2p2 ---x------ --s- 2 BPXROOT @ISZOST1 401408 Sep 29 2011 visudo-1.7.2p2

gngrossi commented 1 month ago

@IgorTodorovskiIBM Why are these executables with setuid? thanks

/hewitt/zopentools/guild/sudo-1.9.15p5 bash-5.2$ ls -l sbin -rwsr-x--- 1 @02858 @ISCICS1 8478720 Jun 13 16:31 sudo_logsrvd -rwsr-x--- 1 @02858 @ISCICS1 8208384 Jun 13 16:31 sudo_sendlog -rwsr-x--- 1 @02858 @ISCICS1 6848512 Jun 13 16:32 visudo