Bug 64823 – suidperl suggestion

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Torgeir Hansen 2004-09-20 23:08:09 UTC]

(see bug63437 and bug63612)

Some of us need the suidperl to stay put; so I'd like it if this was introduced as a USE option - this way systems not needing it will be secure, and my (and others) systems won't break every time a new perl version is available, or even worse; I'd chattr +i {suidperl,sperl*} and end up with a non-updating version of a already critical component :/

I'm marking this as major since this is a big issue to me, and probably to others who need it aswell!

[Comment 1 Andy Grundman 2004-09-24 10:24:14 UTC]

I'd like to also recommend the USE approach.  Perl can be built without suid support, so the current method of just deleting the suidperl and sperl* binaries could be replaced by a USE flag that enables the -Ddo_suid configure option.  I will attach a patch to the ebuild that does this.  

[Comment 2 Andy Grundman 2004-09-24 10:26:03 UTC]

Created attachment 40308 [details, diff]
Patch to add suid USE flag

[Comment 3 Michael Cummings (RETIRED) 2004-09-25 06:24:59 UTC]

http://perldoc.com/perl5.8.4/INSTALL.html#suidperl

[Comment 4 Andy Grundman 2004-09-25 07:54:19 UTC]

Yeah, it's insecure but I think people should have the option to install it if they want.  It should be disabled by default though, of course.

[Comment 5 Torgeir Hansen 2004-09-26 23:21:19 UTC]

I agree with Andy, and I understand the risks aswell!
But - isn't gentoo supposed to be about the choices?

Disable it by default; but give us an option to install it! This should protect the usual morons but give some of us an option to be REAL morons by using suidperl! ;]

However, I do not agree with andy to use 'suid' as the USE keyword, perhaps 'suidperl' would be more appropriate?

[Comment 6 Michael Cummings (RETIRED) 2004-09-28 01:54:37 UTC]

Local use flag added that enables perlsuid <-- that's the use flag 

[Comment 7 Michael Cummings (RETIRED) 2004-10-02 08:55:55 UTC]

*** Bug 63603 has been marked as a duplicate of this bug. ***