The execv() function expects an array of NULL terminated strings but doesn't take the number of arguments. It uses a sentinel value (NULL pointer) to determine when the array ends. The man page fo...

I have a process with permissions 4750. Two users exist in my Linux system. The root user and the appz user. The process inherits the permissions of a process manager that runs as "appz" user. I ...

The combination of set-uid and a relative path in the INTERP section of an ELF binary is very dangerous. I'm not quite sure how and where this problem should be reported, but it seems to me like ...

I need to run a bash script as root (passwordless sudo or su not viable) and since you cannot setuid a script in Linux, I thought about calling it from an executable and making it setuid: $ cat wr...

I have a question regarding the Mac App Store. I am planning to release a software with admin privileges to achieve its core functionality, but according to Apple - 2.27 - Apps that request esca...

I'm trying to do the safe thing, and have a program that needs to runs as root to drop its privileges when it doesn't need them. This works well if I chmod my binary with the SUID bit, and make it ...

Why this simple programs that use os.setuid()/gid() fails? Is written in python but I think that is not a language relative problem (at the end are all the same posix system call): import os, pwd ...

Consider this scenario in which an executable A.bin uses libY.so and libZ.so. A.c, Y.c and Z.c are all written in C. Z.c and Y.c are compiled into respective .so files. This is the directory struc...

I had to do a dirty Linux hack for somebody so they could start a printer with the cupsenable printername shell command while being a non-root user. I didn't want them to be able to use the entiret...

Can anyone point to some code that deals with the security of files access via a path specified (in part) by an environment variable, specifically for Unix and its variants, but Windows solutions a...