Date: Tue, 10 Oct 2000 10:39:03 +0100 From: Dominic Mitchell <hdm@mistral.co.uk> To: lwn@lwn.net Subject: Checking for programs that use curses Here's a quick script that checks a specified directory for programs linked against curses. It may help to identify candidate programs for de suid'ing. Sample output on my FreeBSD box: --------[ checkcurses /usr/bin ]---------------------------------------- -r-xr-xr-x 1 root wheel 62292 Oct 1 06:10 /usr/bin/bc -r-xr-xr-x 1 root wheel 8400 Oct 1 06:11 /usr/bin/dialog -r-xr-xr-x 3 root wheel 52440 Oct 1 06:20 /usr/bin/edit -r-xr-xr-x 3 root wheel 52440 Oct 1 06:20 /usr/bin/ee -r-xr-xr-x 6 root wheel 279664 Oct 1 06:21 /usr/bin/ex -r-xr-xr-x 3 root wheel 83024 Oct 1 06:20 /usr/bin/ftp -r-xr-xr-x 3 root wheel 83024 Oct 1 06:20 /usr/bin/gate-ftp -r-xr-xr-x 1 root wheel 120640 Oct 1 06:12 /usr/bin/info -r-xr-xr-x 2 root wheel 85744 Oct 1 06:20 /usr/bin/less -r-xr-xr-x 2 root wheel 85744 Oct 1 06:20 /usr/bin/more -r-xr-xr-x 1 root wheel 14104 Oct 1 06:20 /usr/bin/msgs -r-xr-xr-x 6 root wheel 279664 Oct 1 06:21 /usr/bin/nex -r-xr-xr-x 6 root wheel 279664 Oct 1 06:21 /usr/bin/nvi -r-xr-xr-x 6 root wheel 279664 Oct 1 06:21 /usr/bin/nview -r-xr-xr-x 3 root wheel 83024 Oct 1 06:20 /usr/bin/pftp -r-xr-xr-x 3 root wheel 52440 Oct 1 06:20 /usr/bin/ree -r-xr-xr-x 2 root wheel 13428 Oct 1 06:21 /usr/bin/reset -r-xr-sr-x 1 root kmem 56648 Oct 1 06:21 /usr/bin/systat -r-xr-xr-x 1 root wheel 16312 Oct 1 06:21 /usr/bin/talk -r-xr-xr-x 1 root wheel 98204 Oct 1 06:25 /usr/bin/telnet -r-xr-sr-x 1 root kmem 32104 Oct 1 06:21 /usr/bin/top -r-xr-xr-x 1 root wheel 5524 Oct 1 06:21 /usr/bin/tput -r-xr-xr-x 2 root wheel 13428 Oct 1 06:21 /usr/bin/tset -r-xr-xr-x 1 root wheel 8408 Oct 1 06:21 /usr/bin/ul -r-xr-xr-x 6 root wheel 279664 Oct 1 06:21 /usr/bin/vi -r-xr-xr-x 6 root wheel 279664 Oct 1 06:21 /usr/bin/view -r-xr-xr-x 1 root wheel 100456 Oct 1 06:21 /usr/bin/window ------------------------------------------------------------------------ Hope this is of some use. -Dom #!/bin/sh # # Check for which programs are linked against curses. # file $1/* | grep 'ELF.*dynamic' | cut -d: -f1 | xargs ldd | awk '/^[/]/{prog=$1} /curses/{print prog}' | tr -d : | xargs ls -l