Messages in this thread |  | | | Date | Sat, 17 Apr 1999 08:52:03 -0700 | | From | Andrew Morgan <> | | Subject | Re: using capabilities to allow debug of suid-root programs (ptrace not allowed even after dropping privs) |
| |
Andrew Morgan wrote: > > Peeter, > > I've attached a wrapper program that should allow this and only this. > Without filesystem capabilities (2.3 stuff), you'll have to make do with > some sort of wrapper. You'll need to make this wrapper setuid root.
Don't you just hate it when that happens.. Here's the attachment.
Cheers
Andrew#include <stdio.h> #include <stdlib.h> #include <unistd.h>
/* make this program setuid root */ void main(int argc, char **argv) { int i; char ** new_args = calloc(argc+4, sizeof(char **)); if (new_args == NULL) { fprintf(stderr, "no memory\n"); exit(1); } setuid(geteuid());
new_args[0] = "/sbin/execcap"; new_args[1] = "execcap"; new_args[2] = "cap_sys_ptrace=i"; new_args[3] = "/usr/bin/strace";
for (i=0; ++i<argc; ) { new_args[3+i] = argv[i]; } execvp(new_args[0], new_args+1);
fprintf(stderr, "Unable to execute command: %s\n", strerror(errno)); for (i=0; new_args[i]; ++i) { printf(" %s", new_args[i]); } printf("\n"); exit(1); } |  |