audit use of setuid/setgid to drop privileges

[grondo]

pdsh may be installed setuid on systems where the rsh based rcmd module is required in order to bind to reserved ports with rresvport. If pdsh detects it is running setuid (by comparing real and effective uids), it uses privilege separation to create a process just for rresvport and then the main process drops privileges.

The dropping of setuid privileges is a potential source of bugs and should be audited, using this CERT reference and its related papers as a guide:

https://www.securecoding.cert.org/confluence/display/c/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges

[garlick]

I wonder if anyone would care if we just dropped support for rsh?

Maybe these days ssh should be the default connection method?