Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Suppose that in FreeBSD (or linux maybe) there is a non-privileged normal user (non-superuser). And there is a telnet standalone (I know that telnet is usually run under inetd) running under (owned by) this user. (Suppose that there was no original, root-owned telnet running.) This telnet server is programmed so that it does not check ld_* environment variables before passing it to /bin/login owned by root that has setuid set up.

The question would be: 1. Will this telnet work? 2. If it does work, will it even be able to pass environment variables to /bin/login?

share|improve this question

closed as not constructive by Canadian Luke, DragonLord, 8088, Indrek, grawity Sep 24 '12 at 8:14

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 0 down vote accepted

Suppose that in FreeBSD (or linux maybe) there is a non-privileged superuser.

"Non-privileged superuser" is a contradiction in terms; the word "superuser" itself means a user having all privileges.

This telnet server is programmed so that it does not check ld_* environment variables

I'm not sure if this is relevant. The telnet server doesn't have any special privileges, so stripping LD_* variables is not very useful...

  1. Will this telnet work? 2. If it does work, will it even be able to pass environment variables to /bin/login?

It will partially work, but it will likely be unable to bind to the standard Telnet port due to missing CAP_NET_BIND_SERVICE privilege.

Yes, it will be able to pass environment variables to login, just like any other process can. However, at least on Linux, the loader (ld-linux.so) discards all LD_* variables before running a setuid program, so a setuid-login would be unaffected by them.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.