[plug] chown as a user?

[Beau Kuiper]

On Sat, 17 Jun 2000, The Thought Assassin wrote:
> On Sat, 17 Jun 2000, Trevor Phillips wrote:
> > I need to be able to let a user change files owned by them, to be owned by
> > someone else. 
> 
> The ability to do this would result in serious Denial-of-Service attacks
> through exhausting disk space. Find another way of doing what you are
> trying to do, or create a highly restricted loophole in chown's security,
> perhaps with sudo. Perhaps if you detail your intentions for the script,
> we can devise a better way of doing it?

Not only that, you can steal email from other users (set a .forward in their
name in their home directory), run programs as other users (chown a setuid
program to another user, and then run it), and lots of other nasty things.

Basicly, it is something you DONT wan't to do

Beau Kuiper
kuiperba at cs.curtin.edu.au