Re: Are setuid #!/foo/bar scripts secure in Linux ?

H. Peter Anvin (
19 Aug 1996 21:16:37 GMT

Followup to: <>
By author: Darren J Moffat <>
In newsgroup:
> Nice, Idea but the way Perl does it is _very_, _very_, bad I just spent 3
> days trying to get a script that works perfectly well non setuid running
> when it as setuid (this is what prompted the original message) I had to
> rewrite nice clean code into hacky regexps with selections from them on
> the next line because of the way perl taints untrusted data.
> eg.
> In the non setuid version
> $device = $ARGV[0];
> In the setuid version
> $ARGV[0] =~ /(\S+)/;
> $device = $1;
> I know the regexps aren't complex but the setuid version is a major hack.
> If fact this belongs in a perl-advocacy list so I won't bring it up again.

Well, you *should* check that noone trying to make you pass something
as a flag or the like; if you don't want to do it "manually", then
define a subroutine:

sub launder {
local($arg) = @_[0];
$arg =~ /^-P(\w+)$/;
return $1;

$device = &launder($ARGV[0]);

Then run taintperl directly if you want to debug nonsetuid.