Subject: [235] Re: [232] static ls for SunOS

From: "Randolph J. Herber" <[email-masked]>
Date: Thu, 28 Jul 1994 14:57:43 -0500

|Date: Thu, 28 Jul 1994 10:47:29 -0600 (MDT)
|From: [email-masked] (Greg Woods)
|Subject: [232] static ls for SunOS

|For anyone who is having trouble with "ls" or "dir" under SunOS: copying
|all the shared libraries to anonymous FTP space is a kludge, and might
|even be a security hole. I just use a statically-linked version of "ls";
|it's a lot easier! The version I have was compiled from old source 
|(SunOS 4.0.3), but it works on SunOS 4.1.1 through SunOS 4.1.3_U1.
|Since it's already in the anonymous FTP area anyway, you can grab mine.
|It's in ftp.ucar.edu:bin/ls. It works for me, but no support or guarantees
|come with it.

|--Greg

It is not a kludge when it is the proper (and only) way to get shared
libraries to work in a chroot(2) environment.

It is no more a security hole than the original copies in their original
locations.  One must be certain to set the proper permissions and
ownerships on all files and directories.

But, I do agree that it is easily more work to get shared library environments
correct than it is to get statically linked executables correct.

Randolph J. Herber, [email-masked], +1 708 840 2966, CD/HQ
(Speaking for myself and not for US, US DOE, FNAL nor URA.)
(Product, trade, or service marks herein belong to their respective owners.)

---

From: [email-masked] (Greg Woods)
Date: Thu, 28 Jul 1994 15:22:26 -0600 (MDT)

> libraries to work in a chroot(2) environment.

Yes, but you don't really NEED shared libraries to work if all you want
is "ls" to work.

> locations.

Well, if you assume that the FTP daemon worked exactly as it should and
didn't have any security holes of its own, then you'd be right, but having
shared libraries in anonymous FTP space might make it possible for a hacker
to exploit a security hole in the FTP daemon (and we've already seen several
in WUFTPD) to plant a trojan horse and open the door wider. I would claim
that anything that is accessible to everyone on the Internet is naturally
more of a security hole than the original copies in their original locations.

> correct than it is to get statically linked executables correct.

That was really the main point. Setting up all the shared libraries and device
files just to get "ls" to work for anonymous FTP users is like killing
a fly with a pile driver.  Now, if you want to run all the ftpconversion
stuff too so that you have at least more executable files in your ~ftp/bin
directory than you do libraries in ~ftp/usr/lib, then maybe the tradeoff
would work the other way.

--greg