Red Hat Bugzilla – Bug 58843
chown does not strip suid bit
Last modified: 2007-04-18 12:39:12 EDT
Description of Problem:
chowning an suid file does not strip the suid bit.
IMHO this is an important safety feature. I'm not sure at which version the 2.4
kernel series began doing this, but in 2.2 it was added into 2.2.13:
(search for string "chown").
Steps to Reproduce:
1. chown nobody /bin/su
2. ls -l /bin/su
-rws--x--- 1 nobody wheel 18452 Jul 23 2001 /bin/su
-rwx--x--- 1 nobody wheel 18452 Jul 23 2001 /bin/su
Reproducible at least on kernel-2.4.9-21
POSIX does not require this, furthermore there are other reasons it is a bad
idea such as mandatory locking flags. See the man page for a detailed discussion