Yesterday I said that the kerneldirectly executes programs in place. Because I feel like walkingthrough the details, here is what the kernel does to start ELF programs onx86 Linux; for simplicity, I'm going to talk about 32-bit programs.

• First, the kernel maps the program's text, data, and BSS into memory. Almost allprograms require these to be mapped at fixed addressesstarting from 0x08048000 (128 Mb)

The real problem with setuid scripts on Unix isnot that writing secure shell scripts is challenging and obscure, itis that they are fundamentally insecure because of how the kernel runsthem. While the kernel runs programs by directly loading them intomemory , it runs scripts by running thescript's interpreter with the filename of the script, leaving it up tothe interpreter to read and execute the script itself. As is normal onUnix, there is nothing that keeps what file the filename points tothe same between these two