files with SUID?

[meshbander]

Hi every body

1-I have checked my machine for files SUID or SGID and I found the following files:

ls -l /proc/1822/exe
lrwxrwxrwx. 1 root root 0 2010-06-27 17:45 /proc/1822/exe -> /usr/lib/vte/gnome-pty-helper
[root@localhost ~]# ls -l /usr/lib/vte/gnome-pty-helper
-rwx--s--x 1 root utmp 13068 2009-09-28 20:50 /usr/lib/vte/gnome-pty-helper

what does the -> means?

2-I have list of files set with SUID and SGID taken from my machine but I am not sure are there any files should not set with SUID or SGID and how can I now the standrd list of file that should be set with SUID and SGID.

the found list is as follow:

/usr/kerberos/bin/ksu
/usr/libexec/pt_chown
/usr/libexec/openssh/ssh-keysign
/usr/libexec/polkit-1/polkit-agent-helper-1
/usr/libexec/utempter/utempter
/usr/libexec/pulse/proximity-helper
/usr/lib/sendmail
/usr/lib/sendmail.sendmail
/usr/lib/nspluginwrapper/plugin-config
/proc/1822/exe -> /usr/lib/vte/gnome-pty-helper
/proc/1822/task/1822/exe -> /usr/lib/vte/gnome-pty-helper
/usr/sbin/ccreds_chkpwd
/usr/sbin/sendmail
/proc/1772/exe -> /usr/sbin/sendmail.sendmail
/proc/1772/task/1772/exe -> /usr/sbin/sendmail.sendmail
/proc/1774/exe -> /usr/sbin/sendmail.sendmail
/proc/1774/task/1774/exe -> /usr/sbin/sendmail.sendmail
/usr/sbin/suexec
/usr/sbin/userhelper
/usr/sbin/ping6
/usr/sbin/lockdev
/usr/sbin/usernetctl
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/atq
/usr/bin/gpasswd
/usr/bin/write
/usr/bin/newaliases
/usr/bin/mailq.sendmail
/usr/bin/same-gnome
/usr/bin/newaliases.sendmail
/usr/bin/gnomine
/usr/bin/chage
/usr/bin/pkexec
/usr/bin/iagno
/usr/bin/wall
/usr/bin/fusermount
/usr/bin/lockfile
/usr/bin/rsh
/proc/1280/exe -> /usr/bin/Xorg
/proc/1280/task/1280/exe -> /usr/bin/Xorg
/usr/bin/mailq
/usr/bin/purgestat
/usr/bin/chsh
/usr/bin/crontab
/usr/bin/crontab
/usr/bin/atrm
/usr/bin/rlogin
/usr/bin/abrt-pyhook-helper
/usr/bin/abrt-pyhook-helper
/usr/bin/locate
/usr/bin/sudo
/usr/bin/at
/usr/bin/rcp
/usr/bin/sudoedit
/usr/bin/ssh-agent
/usr/bin/sg
/usr/bin/X
/usr/bin/hoststat
/usr/bin/passwd
/lib/dbus-1/dbus-daemon-launch-helper
/etc/alternatives/mta-newaliases
/etc/alternatives/mta-mailq
/etc/alternatives/mta
/etc/alternatives/mta-sendmail
/sbin/unix_chkpwd
/sbin/pam_timestamp_check
/sbin/mount.nfs
/sbin/umount.nfs4
/sbin/netreport
/sbin/umount.nfs
/sbin/mount.nfs4
/bin/umount
/bin/ping
/proc/2007/task/2007/exe -> /bin/su
/proc/2007/exe -> /bin/su
/proc/2026/exe -> /bin/su
/proc/2026/task/2026/exe -> /bin/su
/proc/2046/exe -> /bin/su
/proc/2046/task/2046/exe -> /bin/su
/proc/2100/exe -> /bin/su
/proc/2100/task/2100/exe -> /bin/su
/bin/mount
/bin/fusermount
/bin/ping6
/proc/2589/exe
/proc/2589/task/2589/exe
/proc/3083/exe
/proc/3083/task/3083/exe
/proc/3085/exe
/proc/3085/task/3085/exe
/proc/1346/exe
/proc/1346/task/1346/exe
/proc/1878/exe
/proc/1878/task/1878/exe
/proc/1879/exe
/proc/1879/task/1879/exe
/proc/2178/exe
/proc/2178/task/2178/exe

[SteveGYBE]

1. The clue is the first character on the line of the "ls -l" output - the "l" says the file is a symbolic link and the "->" indicates the link target - i.e. the file linked to.

2. Firstly, ignore anything in /proc - this is used by the system to keep track of running processes so you should not be altering anything in there (if indeed you could anyway). You could try "rpm -Va" - this will list all files which differ from when installed, including those with different file modes (=permissions). Be warned though, this can take more than half an hour to run, depending on the number of packages (files) installed.

[Evil_Bert]

In addition to the above, the NSA's guide to securing RHEL5 is a good place to start:

http://www.nsa.gov/ia/_files/os/redh...guide-i731.pdf (you may have to open the parent page first, then find the link within the page)

If you download/open the above document and navigate to section 2.2.3.4, there is guidance on SUID/SGID binaries.