Programming Perl, 4th Edition

Unix Kernel Security Bugs

Beyond the obvious problems that stem from giving special privileges to interpreters as flexible and inscrutable as shells, older versions of Unix have a kernel bug that makes any set-id script insecure before it ever gets to the interpreter. The problem is not the script itself, but a race condition in what the kernel does when it finds a set-id executable script. (The bug doesn’t exist on machines that don’t recognize #! in the kernel.) When a kernel opens such a file to see which interpreter to run, there’s a delay before the (now set-id) interpreter starts up and reopens the file. That delay gives malicious entities a chance to change the file, especially if your system supports symbolic links.

Fortunately, sometimes this kernel “feature” can be disabled. Unfortunately, there are a couple of different ways to disable it. The system can outlaw scripts with the set-id bits set, which doesn’t help much. Alternatively, it can ignore the set-id bits on scripts. In the latter case, Perl can emulate the setuid and setgid mechanism when it notices the (otherwise useless) set-id bits on Perl scripts. It does this via a special executable called suidperl, which is automatically invoked for you if it’s needed.^[196] However, if the kernel set-id script feature isn’t disabled, Perl will complain loudly that your setuid script is insecure. You’ll either need to disable the kernel set-id script “feature” or put a C wrapper around the script. A C wrapper is just a compiled ...