4 ms·
I'll share my story. I used to work at a popular Linux website hosting control panel company. Back in the early 2000's "frontpage extensions" were a thing that
by bvinc 8y ago
I'll share my story. I used to work at a popular Linux website hosting control panel company. Back in the early 2000's "frontpage extensions" were a thing that people used to upload their websites.
Unfortunately, frontpage extensions required files to exist in people Linux home directories, and people would often mess them up or delete them. People would need their frontpage extension files "reset" to fix the problem. Fortunately, Microsoft provided a Linux binary to reset a users frontpage extension files.
Unfortunately, it required root access to run. Also unfortunately, I discovered that a user could set up symlinks in their home directory to trick the binary into overwriting files like /etc/passwd.
We ended up actually releasing a code change that would overwrite getuid with LD_PRELOAD so that the Microsoft binary would think it was running as root, just to prevent it from being a security hazard.
- deleted 8y ago[deleted]
- mixmastamyk 8y agoSo, it didn’t need root, but insisted on it? A MS binary no less.
- Twirrim 8y agoIt was very much in keeping of the Microsoft of the era. Not out of maliciousness. Just a general lack of interest or knowledge of any non-Windows platform, but a recognition that if Frontpage was going to be as dominant as they wanted, they at least needed to vaguely support it. Think the worst case of "Well it works on my machine"
- saagarjha 8y agoWas there no way to jail or chroot the binary?
- q3k 8y agoIn the 'early 2000s' there was no security-focused containerization available on Linux.
- pjc50 8y agoAh, I remember how bad this era of Microsoft was. Debian have a similar tool called "fakeroot" which is part of their packaging process.