This is because of programs that do things like
execve(argv[0], argv, environ);
when running setuid. (Since argv[0] can be set by the parent process,
it's trivial to set it to /bin/sh and thus get a shell.)
> IRIX users will get nastily bit if they wrap /sbin/df, because /etc/devnm
> (a symlink to df) will produce wierd results, causing the boot sequence to
> fail to create the root device links /dev/root and /dev/rroot, along with
> any tape device links. Your system will still boot normally, but you won't
> have access to your tape drives and the system will claim that the root
> filesystem is not mounted.
Oy. Does this mean that if you ln -s /sbin/df /tmp/devnm and run
/tmp/devnm that it will hose the system?
--
- David A. Holland | VINO project home page:
dholland@eecs.harvard.edu | http://www.eecs.harvard.edu/vino