tag:blogger.com,1999:blog-32189452.post2699684013237952519..comments2020-10-01T16:11:58.925+01:00Comments on ScotGrid: Lunch with glexec developersGraeme Stewarthttp://www.blogger.com/profile/04113191724360870254noreply@blogger.comBlogger1125tag:blogger.com,1999:blog-32189452.post-28322295423638933402008-01-11T16:35:00.000+00:002008-01-11T16:35:00.000+00:00IMHO there are major problems with the glexec impl...IMHO there are major problems with the glexec implementation. It is a <B>very bad</B> idea to have a suid script that links to dozens of libraries (that were not even design to be used in this way).<BR/><BR/>Take for example the LCAS/LCMAPS libraries, what do you think it will happen if I do something like<BR/>"env LCMAPS_LOG_FILE=/etc/passwd glexec"<BR/>for example?<BR/><BR/>Of course this specific <I>attack</I> might not work but there will be other ones that will work.Anonymoushttps://www.blogger.com/profile/03503328263670563368noreply@blogger.com