[K12OSN] Re: Dropbox directory permissions

[Robert Arkiletian]

On 3/4/07, Robert Arkiletian <robark at gmail.com> wrote:
> mkdir /home/inbox
> chmod 1773 /home/inbox  (Not readable by others and sticky bit
> prevents overwriting)
>
> But if a clever kid happens to know the filename of another kid
>
> cp /home/inbox/filename ~
>
> unfortunately works. Not good.
> ==============================
> My solution:
> Write a 1 line bashscript /usr/bin/handin
>
> cp -p $1 /home/inbox/
>
> chgrp teacher /usr/bin/handin
> chmod 2755 /usr/bin/handin   (setgid escalate priviliges to teacher group)
>
> now
>
> chgrp teacher /home/inbox
> chmod 1770 /home/inbox
>
> To hand-in a test students go
> handin filename
>
> But it does not work. I get
>
> cp: cannot stat `/home/inbox/filename': Permission denied
>
> Why? Apparently, setgid cannot change the group of the process to one
> which you don't already belong to. So I have to add the teacher group
> to all students, which defeats the purpose. So much for privilege
> escalation of setgid. I even tried using setuid.
>
> [root at server ~]# ls -ld /home/inbox/
> drwxrwx--T  2 root root 4096 Mar  4 16:02 /home/inbox/
> [root at server ~]# ls -l /usr/bin/handin
> -rwsr-xr-x  1 root root 79 Mar  3 14:40 /usr/bin/handin
>
> I get the same stat Permission denied error. Any suggestions?
>

Turns out bash doesn't allow setuid scripts for security reasons.

http://www.linuxquestions.org/questions/showthread.php?t=527066

So I made a C++ script and it STILL failed with the same error.


#include <cstdlib>
#include <string>
using namespace std;
int main(int argc, char *argv[])
{
string line("cp -pf ");
line =line+argv[1]+" /home/ccc/";
system(line.c_str());
return (0);
}

compile it with
g++ source.cc -o binary

I have never tried using setuid before. I think I must be missing something.
-- 
Robert Arkiletian
Eric Hamber Secondary, Vancouver, Canada
Fl_TeacherTool http://www3.telus.net/public/robark/Fl_TeacherTool/
C++ GUI tutorial http://www3.telus.net/public/robark/