{"id":103,"date":"2012-01-15T18:01:46","date_gmt":"2012-01-15T18:01:46","guid":{"rendered":"https:\/\/trouble.org\/wp\/?p=103"},"modified":"2015-07-22T09:33:30","modified_gmt":"2015-07-22T09:33:30","slug":"looking-for-a-good-man1","status":"publish","type":"post","link":"https:\/\/trouble.org\/?p=103","title":{"rendered":"looking for a good man(1)"},"content":{"rendered":"

I like documentation. \u00a0 Programs should have it. \u00a0But on the heels of the man path thing<\/a>\u00a0I did some more looking on my\u00a0\u00a0Snow Leopard System.<\/p>\n

Finding all the SUID files outside the traditional \/sbin areas shows a few more (e.g. “find -x \/ -type f -perm -04000 -ls”.) \u00a0 Looks like 15 files, 8 of them by 3rd party vendors (good to know lazy coders are still out there):<\/p>\n

\/Applications\/Utilities\/Keychain Access.app\/Contents\/Resources\/kcproxy
\n\/Library\/Application Support\/Logitech.localized\/Logitech Control Center.localized\/LCCDaemon.app\/Contents\/Resources\/SetPriority
\n\/Library\/Application Support\/StreamWatcher\/StreamCaptureTool
\n\/Library\/Application Support\/VMware Fusion\/VMDKMounter.app\/Contents\/MacOS\/vmware-vmdkMounterTool
\n\/Library\/Application Support\/VMware Fusion\/vmware-authd
\n\/Library\/Application Support\/VMware Fusion\/vmware-rawdiskCreator
\n\/Library\/Application Support\/VMware Fusion\/vmware-usbArbitratorTool
\n\/Library\/Application Support\/VMware Fusion\/vmware-vmx
\n\/Library\/Application Support\/VMware Fusion\/vmware-vmx-debug
\n\/System\/Library\/CoreServices\/RemoteManagement\/ARDAgent.app\/Contents\/MacOS\/ARDAgent
\n\/System\/Library\/Printers\/IOMs\/LPRIOM.plugin\/Contents\/MacOS\/LPRIOMHelper
\n\/System\/Library\/PrivateFrameworks\/Admin.framework\/Versions\/A\/Resources\/readconfig
\n\/System\/Library\/PrivateFrameworks\/Admin.framework\/Versions\/A\/Resources\/writeconfig
\n\/System\/Library\/PrivateFrameworks\/DesktopServicesPriv.framework\/Versions\/A\/Resources\/Locum
\n\/System\/Library\/PrivateFrameworks\/Install.framework\/Versions\/A\/Resources\/runner<\/div><\/div>\n

No man pages here either… but thanks to the\u00a0streamwatcher<\/a>\u00a0programmers who put a SUID binary when I installed the test version.<\/p>\n

VMware was kind enough to put a 33MB and a 41MB SUID on my system, I’m sure they have no security issues. \u00a0Do they honestly think you can make 40 megs of SUID executable safe? \u00a0 ARDAgent, another 1.8MB SUID… searching… great, tons of holes found in that already, some people never learn. \u00a0Bah, time to strip off the SUID bit.<\/span><\/p>\n

Let’s see… “find \/System -type f -perm -00100 -ls |wc” gives… 3594 executables. \u00a0Probably not all of them, so run file(1) on them all, and:<\/p>\n

1649 Mach-O universal binary with 3 architectures
\n876 Mach-O universal binary with 2 architectures
\n…. and a whole lot more… perl, python, other scripts, conf files….<\/p><\/blockquote>\n

Surely they have documentation? \u00a0Find reveals… 104 man page lookin’ things in \/System and \/Library, almost all for python, ruby, TK stuff. \u00a0And when apple puts in 5 different executables called QuartzComposer… what are you supposed to think when you see it running?<\/p>\n

-rwxr-xr-x 1 root wheel 10182784 Apr 29 2011 \/System\/Library\/Frameworks\/Quartz.framework\/Versions\/A\/Frameworks\/QuartzComposer.framework\/Versions\/A\/QuartzComposer
\n-rwxr-xr-x 1 root wheel 95424 May 19 2009 \/System\/Library\/Frameworks\/Quartz.framework\/Versions\/A\/Frameworks\/QuartzComposer.framework\/Versions\/A\/Resources\/QuartzComposer.ibplugin\/Contents\/MacOS\/QuartzComposer
\n-rwxr-xr-x 1 root wheel 54704 Sep 15 2010 \/System\/Library\/Frameworks\/QuickLook.framework\/Versions\/A\/Resources\/Generators\/QuartzComposer.qlgenerator\/Contents\/MacOS\/QuartzComposer
\n-rwxr-xr-x 1 root wheel 132848 Jun 25 2010 \/System\/Library\/QuickTime\/QuartzComposer.component\/Contents\/MacOS\/QuartzComposer
\n-rwxr-xr-x 1 root wheel 48912 May 18 2009 \/System\/Library\/Spotlight\/QuartzComposer.mdimporter\/Contents\/MacOS\/QuartzComposer<\/div><\/div>\n

Some of these are documented pretty well in other ways (Automator and some other apps), but there are many more than have zero… picking a random one in \u00a0\/System\/Library\/CoreServices\/, I see\u00a0SystemUIServer.app has a program called\u00a0uiscriptrunner that it presumably runs… what does that do? \u00a0No documentation, no mention of it at all on apple.com via google or their search engine.<\/p>\n

 <\/p>\n

A big, black box.<\/p>\n

 <\/p>\n

Get off my lawn, all of you.<\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

I like documentation. \u00a0 Programs should have it. \u00a0But on the heels of the man path thing\u00a0I did some more looking on my\u00a0\u00a0Snow Leopard System. Finding all the SUID files outside the traditional \/sbin areas shows a few more (e.g. “find -x \/ -type f -perm -04000 -ls”.) \u00a0 Looks like 15 files, 8 of […]<\/p>\n","protected":false},"author":44,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33,32,4,6],"tags":[41,40,39],"class_list":["post-103","post","type-post","status-publish","format-standard","hentry","category-dinosaur","category-mac","category-security","category-tech","tag-40megs-of-suid-and-counting","tag-damn-docs","tag-getting-old"],"_links":{"self":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=103"}],"version-history":[{"count":19,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/103\/revisions"}],"predecessor-version":[{"id":1144,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/103\/revisions\/1144"}],"wp:attachment":[{"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}