Fedora and pkexec

Posted Feb 17, 2022 20:14 UTC (Thu) by nix (subscriber, #2304)
In reply to: Fedora and pkexec by mjg59
Parent article: Fedora and pkexec

> but then they can create a sgid binary that would allow them to retain access

I have long wondered why the ability to do this as a regular user didn't go away at the same time as the ability to give away things with chown as a regular user. They seem to enable the same sort of evasive behaviour...

Fedora and pkexec

Posted Feb 18, 2022 10:38 UTC (Fri) by farnz (subscriber, #17727) [Link]

That change happened in the days when systems were relatively static compared to today's setups. So your groups vector would be the same whether you were logged in or not, and thus a SGID binary wouldn't elevate your permissions; you could only use it as a way to elevate someone else to your permissions.

In contrast, giving away files to someone else is a hole in the world where everything's static; it lets you claim their quota, for a start.