View Single Post
Posts: 1,067 | Thanked: 2,383 times | Joined on Jan 2012 @ Finland
#131
Originally Posted by wicket View Post
The second thing I discovered was that it is actually possible to run an incepted opensh shell as a regular user and gain full root privileges without needing to supply a root password!

This is obviously a huge security hole. I'd also like know if this problem occurs when running opensh under an open-mode kernel.

I suggest that anyone using an incepted opensh locks down both /bin/opensh and /bin/open-sh executables with 700 permissions until this is sorted.
Obviously inception as such is a huge security hole. It has been always known that if you want to bypass password query you install opensh, and if you want to have the password query, then you incept develsh. As only difference between develsh and opensh is the default current user vs. setuid(0).