Passing script by fd on Linux and setuid scripts

[Petr Skočík]

Hi.

The bash reference mentions that /dev/fd/* files are treated specially,
as filedescriptors, when used in conditionals.

However, they're not if they're passed as script arguments to the bash
binary (e.g., `bash /dev/fd/3`).

If they were, it would be possible to have a small setuid-root
indirection binary start bash scripts via filedescriptors, thereby
eliminating the race condition setuid-script vulnerability mentioned in
Gilles's answer at
http://unix.stackexchange.com/questions/364/allow-setuid-on-shell-scripts#2910.

(Whether the rest of the execution would be secure with setuid is
another question)

Running readlink on the actual /dev/fd/$something could then be used to
set $0.

I think it would make sense. What do you think?

Attached is a tentative patch that implements the above described
functionality.

Best regards,
Petr Skocik

passing-scripts-via-fds.patch
Description: Text Data