Messages in this thread |  | | | Date | Sat, 17 Apr 1999 13:48:37 -0400 | | From | mukesh agrawal <> | | Subject | Re: using capabilities to allow debug of suid-root programs (ptrace not allowed even after dropping privs) |
| |
At 1:17 AM -0400 4/17/99, peeterj@ca.ibm.com wrote: >Hi Andrew, > >I was looking into the use of linux capabilities to allow debugging of >setuid root programs by allowing cap_sys_ptrace. > >I have built and installed libcap on a machine running 2.2, but now that I >have done so I am not exactly sure how to go about allowing selective >ptrace. The first place I looked into was the faq, but the link >(ftp://ftp.guardian.no/pub/free/linux/capabilities/capfaq.txt) seems to be >dead. Do you know of an updated url? > >The reason that I want to do this is because Linux seems to not allow >debugging of a suid root program even after dropping all root authorities >(even after calling ALL of set[ug]id, sete[ug]id, and setre[ug]id to not >root group and id). However, we need to allow our programmers to debug and >don't neccessarily want to start passing out the root password all over the >place. > >By cc to any kernel developers, is this ptrace behaviour a linux bug, and >if not what is the rational (is more needed then dropping the root >uid/gid?).
The process may have acquired resources by virtue of being suid. Consider an executable called demo
exec("/bin/demo") open("/etc/passwd") /* drop root privileges using setXid/seteXid/setreXid */ then you launch the tracing process
exec("/bin/cracker") ptrace(PTRACE_ATTACH, /bin/demo's pid)
cracker can then manipulate the passwd file however it would like.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
|  |