Download Full eXpert-BSM v.1.5 User Manual

Command: chmod(2)
Ret_Val: 0
Error_Number: 0
Parent Command: chmod
Path List: [ /usr/emerald/em_user1/gurka ]
object_owner: (em_user1|50001)
Test 12: Non-owner Enabled Setuid File
(BSM_SUSPICIOUS_SETUID_ATTACKER)
As em_user1, set the SUID bit on a file owned by em_user2. This is
a
little tricky, you need a program which is setuid to em_user2 that
performs the chmod operation.
Time: 1999-12-30 19:15:16.402415 EST
UserName : em_user1 EffectiveName:
em_user2 AuditName:
em_user1
RUID: 50001
EUID: 50002
AUID: 50001
PID: 25406
Command: chmod(2)
Ret_Val: 0
Error_Number: 0
Parent Command: chmod
Path List: [ /usr/emerald/em_user1/file_owned_by_2 ]
object_owner: (em_user2|50002)
Test 13: Root core dump event (BSM_ROOT_CORE_EVENT)
As root, run for example 'sleep 20' and hit cntrl-\ (hold control
and
press backslash) while the program is running to force a core
dump.
Time: 1999-12-30 19:16:08.512544 EST
UserName : root EffectiveName:
root AuditName: admin_u
RUID: 0
EUID: 0
AUID: 2037
PID: 25411
Command: process dumped core
Ret_Val: 0
Error_Number: 0
Path List: [ /export/home/core ]
object_owner: (root|0)
Test 14: Suspicious symlink creation (BSM_MAKE_TMP_SYM)
As em_user1, create a symbolic link in /tmp.
Time: 1999-12-30 19:17:15.672732 EST
UserName : em_user1 EffectiveName:
em_user1 AuditName:
em_user1
RUID: 50001
EUID: 50001
AUID: 50001
PID: 25420
Command: symlink(2)
Ret_Val: 0
Error_Number: 0
Parent Command: ln
Path List: [ /tmp/grepa ]
EMERALD eXpert-BSM User’s Guide
Page 63