Path: number1.nntp.dca.giganews.com!border1.nntp.dca.giganews.co   
   !nntp.giganews.com!newsfeed00.sul.t-online.de!t-online.de!130.59   
   10.21.MISMATCH!kanaga.switch.ch!switch.ch!newsfeed-du-01.pub.2nd   
   sunrise.ch!not-for-mail   
   Newsgroups: alt.os.linux.ubuntu   
   Date: Mon, 5 Feb 2007 21:07:34 +0100   
   From: Niklaus Kuehnis    
   Subject: Re: starting a console application on first login   
   In-Reply-To: <87r6t4sace.fsf@geemail.com>   
   Message-ID:    
   References:  <87d54otu   
   p.fsf@geemail.com>   
     <87zm7sscl9.fsf@geemail.com>   
     <87r6t4sace.fsf@geemail.com>   
   MIME-Version: 1.0   
   Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed   
   Lines: 30   
   Organization: TDC Switzerland AG, http://www.sunrise.ch   
   NNTP-Posting-Host: 89.217.188.85   
   X-Trace: 1170706049 news.sunrise.ch 3843 89.217.188.85:3501   
   X-Complaints-To: abuse@sunrise.ch   
   Xref: number1.nntp.dca.giganews.com alt.os.linux.ubuntu:9769   
      
   On Mon, 5 Feb 2007, Hadron wrote:   
      
   > Niklaus Kuehnis  writes:   
   >   
   >> On Mon, 5 Feb 2007, Hadron wrote:   
   >>   
   >>> Niklaus Kuehnis  writes:   
   >>>   
   > I'm not sure I follow you. Are you sure you are not overly complicating   
   > the issue? What was wrong again with my solution (ignoring whether it   
   > was the best/worst solution). What is the problem with using sudo in the   
   > sctip file I suggested? It will prompt for pwd or you can set the s bit.   
      
   It would be a bit odd if I had to give a password if nothing is to do    
   (when the script file is missing) but no password would be necessary    
   to execute the script when it's there.   
      
   I didn't know about the s bit. It seems to execute a script as user    
   instead of root. Still, if I put a script into the home directory,    
   writeable to the user, and give it sudo rights without password,    
   couldn't the user execute arbitrary code with root rights, taking the    
   s bit away if necessary?   
      
   Your suggestion (with my modifications, i.e. with all critical    
   commands that are to be sudoed in sbin) would work if I would test    
   for file existence before executing the script.   
      
   And, yes, it's well possible I'm overly complicating the issue.   
      
   Nik   
   --- Platinum Xpress/Win/WINServer v3.0pr5   
    * Origin: Omicron Theta BBS (1:261/20)