Bug in su(1) under 3.5 (and others)

[alberta!ncc!lyndon at uunet.uu.net]

This is an extract of a bug report we submitted to Sun.  Their response?
"Fixed in 4.0"

--lyndon

System:		3/280S -- SunOS 3.5

Attempts to su(1) to a non-root user will fail if a parent of the current
working directory does not have read and execute permission for "others."

This behavior has been verified under 3.4 and 3.5 on different 3/280's,
and under 3.5 on a 3/160. Examination of BSD4.2 su(1) source shows this
bug does not exist there.

The following script shows some examples:

Script started on Wed Oct 19 12:02:08 1988
(12:02pm) ncc:/u0/staff/lyndon/src% ls -ldg .
drwxr-xr-x 30 lyndon   staff        1536 Oct 19 12:02 ./
(12:02pm) ncc:/u0/staff/lyndon/src% ls -ldg ..
drwxr-x--x 74 lyndon   staff        3072 Oct 19 11:09 ../
(12:02pm) ncc:/u0/staff/lyndon/src% su bin
Password:
(12:02pm) ncc:/u0/staff/lyndon/src% echo $status
1
(12:02pm) ncc:/u0/staff/lyndon/src% chmod o+r ..
(12:02pm) ncc:/u0/staff/lyndon/src% ls -ldg ..
drwxr-xr-x 74 lyndon   staff        3072 Oct 19 11:09 ../
(12:02pm) ncc:/u0/staff/lyndon/src% su bin
Password:
ncc% echo $status
0
ncc%
(12:02pm) ncc:/u0/staff/lyndon/src% chmod o-x ..
(12:02pm) ncc:/u0/staff/lyndon/src% su bin
Password:
(12:03pm) ncc:/u0/staff/lyndon/src% echo $status
1
(12:03pm) ncc:/u0/staff/lyndon/src% su
Password:
ncc# echo $status
0
ncc#
(12:03pm) ncc:/u0/staff/lyndon/src%
script done on Wed Oct 19 12:03:42 1988