OBSOLETE Patch-ID# 100633-01
Keywords: ARM, security, login, su, LD_ environment variables
Synopsis: OBSOLETED by 100632
Date: 22/May/92

SunOS release: SunOS 4.1.1, 4.1.2, 4.1.3

Unbundled Product: SunSHIELD, ARM

Unbundled Release: 1.0

Topic: This is ARM version of patch 100630 

BugId's fixed with this patch: 1085851

Architectures for which this patch is available: sun4(all)

Patches which may conflict with this patch: 

Obsoleted by: 100632

Files included with this patch: login, su, su.5bin

Problem Description: a dynamically-linked program that is forked by
a setuid program has access to the callers environmental variables if
the setuid program sets the real UID equal to the effective UID and
the real GID equal to the effective GID before the dynamically-linked
program is forked.

Install Instructions: 

Perform all commands as root.  It is strongly recommended that the install
be performed in single user mode if user logins are possible during the
execution of these commands.  It is assumed that ARM has already been
installed on your system.

Make a copy of the old files:
mv /bin/login /bin/login.ARM.orig
mv /usr/bin/su /usr/bin/su.ARM.orig
mv /usr/5bin/su /usr/5bin/su.ARM.orig

Change permissions on old files so they can't be executed:
chmod 0400 /bin/login.ARM.orig /usr/bin/su.ARM.orig /usr/5bin/su.ARM.orig

Install the patched files:
cp `arch`/login /bin/login
cp `arch`/su /usr/bin/su
cp `arch`/su.5bin /usr/5bin/su

Change the owner and file permissions of the new files:
chown root.staff /bin/login /usr/bin/su /usr/5bin/su
chmod 4755 /bin/login /usr/bin/su /usr/5bin/su