On 27. aug. 2009, at 09.44, Fahad Sadah <fahadsadah(a)googlemail.com> wrote: I am interested too. I have experience in administrating a server in the same non-profit organsation as Fahad, but another server. I would guess that the easiest way would be some kind of daemon running as root. Henrik Hodne

On 27. aug. 2009, at 10.14, Leszek Krupinski <leafnode(a)gmail.com> wrote: Doh! I keep forgetting you can limit privileges with sudo. Henrik

On Thu, Aug 27, 2009 at 4:14 AM, Leszek Krupinski<leafnode(a)gmail.com> wrote: Or Solaris roles or whatever they're called, on the Solaris machines. (Whatever it is pfexec does.) MySQL wouldn't even need that; just assign the account the right to view process lists and kill processes. On Thu, Aug 27, 2009 at 5:05 AM, Fahad Sadah<fahadsadah(a)googlemail.com> wrote: Not "most programs", only a minority. Obviously if you can run mount as root with arbitrary parameters, you can mount arbitrary filesystems with, for instance, a setuid root-owned binary on it that does whatever you want. Giving people sudo access to chmod, chown, modprobe, a shell or interpreter or editor, something that's not usually a shell or interpreter or editor but actually can be used as one (like some variants of less), etc., would also obviously give them full access if they wanted. But you're not going to get root access using shutdown or kill or /etc/init.d/apache. It does pay to think about it carefully first, but it's hardly inevitable that limited admins will be able to get full root if you're careful what commands you give them. (I'd think it would be safer to write a wrapper script for kill that made sure you weren't trying to kill a root-owned process, to be on the safe side.) On Thu, Aug 27, 2009 at 8:09 AM, Bryan Tong Minh<bryan.tongminh(a)gmail.com> wrote: If there were some way we knew about that some users could gain root access (and thereby access to private data), those users would have to be approved by Wikimedia, which defeats the point.

On Thu, Aug 27, 2009 at 11:54 AM, Merlijn van Deen<valhallasw(a)arctus.nl> wrote: Any widely-used software with a known buffer overflow gets fixed. This is just as true for shutdown as for ping. You're far *more* likely to find a serious vulnerability in the kernel or services that run as root, just because of their vastly greater LOC. A user who was dedicated enough to try finding a buffer overflow in kill (which is only 16K compiled on nightshade, BTW, and I doubt it's often been changed) could save himself some effort by just waiting for a kernel privilege escalation vulnerability announcement and pulling a zero-day exploit.