Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version has strange permissions at least in /tmp

In a notebook on

uid=1168(sagenbws) gid=1168(sagenbws) groups=1168(sagenbws)
os.system("cat /tmp/tmpzxlnwt/") #someone's code
os.system("find /tmp type -type f -user sagenbws   -ls 2>/dev/null") #sagenbws is us
1615059    4 -rw-r--r--   1 sagenbws sagenbws      568 Dec  5 13:32 /tmp/tmp0uWxta/
WARNING: Output truncated!

Since system commands are supported one can use the notebook as a proxy or send email.

If one starts the notebook from sage via notebook() the user id is the user running sage so anyone who can login to the notebook in this case can execute system commands as the user running sage (by default creating accounts appears disabled to me in this case).