Security Review: Solaris 8 Setuid/Setgid Files
Information Systems and Technology
University of Waterloo


Setuid/Setgid files missing in Solaris 8

There are a couple of Setuid/Setgid files we find in (current up to patch) Solaris 7 that we don't find in Solaris 8:
/usr/platform/sun4m/sbin/eeprom
/usr/sbin/arp
The eeprom is just an architecture difference -- the Solaris 8 system we used was an Ultra-sparc and the same program is found under the sun4u platform. The arp is nice to see -- Sun seems to have recognized that there's no need for this to be setgid (as per our previous recommendations).

There was one Solaris 7 setgid we had found a year ago that (on current up to patch) Solaris 7 is no longer setgid:

/usr/sbin/dmesg
Apparently some patch in the interim has prudently dropped the setgid. Actually it's a much better fix than that! The command used to be setgid so it could do kernel prods. Now it's a simple shell script that just displays information from the syslog files:
[3:39pm sun580] more /usr/bin/dmesg
#!/usr/bin/sh
#
# Copyright (c) 1998 by Sun Microsystems, Inc.
# All rights reserved.
#
#ident  "@(#)dmesg.sh   1.1     98/09/30 SMI"

/usr/bin/echo
/usr/bin/date
/usr/bin/cat -s `/usr/bin/ls -tr1 /var/adm/messages.? 2>/dev/null` \
        /var/adm/messages | /usr/bin/tail -200
That's an elegant solution to the problem -- you no longer need to do any kernel prodding! I'm not sure which patch set gave us that version of the tool but I'm certainly happy to see it.

(by) Reg Quinton, Information Systems and Technology
2000/08/17 - 2003/09/30