Messages in this thread |  | | From | (Miquel van Smoorenburg) | Subject | Re: setuid scripts (was Re: proc fs and shared pids) | Date | 17 Sep 1996 23:16:19 +0200 |
| |
In article <96Sep17.061459+0100met_dst.2333-25720+40@work.smurf.noris.de>, Matthias Urlichs <smurf@smurf.noris.de> wrote: >In linux.dev.kernel, article <Pine.LNX.3.95.960906174146.31788A-100000@xarius.demon.co.uk>, > Darren J Moffat <darren@xarius.demon.co.uk> writes: >> >> $ setuidexec /bin/sh >> Syntax error while executing setuidexec >> Usage: #! setuidexec <shell> >> >> The reason for this is the setuidexec program (as posted in this list) >> does the /dev/fd hack that Solaris 2.x does exactly _and_ checks the >> permisons of the script _and_ creates a minimal standard environment _and_ >> can't be run unless it is called via a #! mechanism. > >But the only way to check the latter is via looking at argv[]. Thus, this >check can be defeated by calling suidexec with a trivial C wrapper.
Yep. You are right there. I posted the suidexec wrapper, so I tried to fix it.
>Nonono... setuidexec _must_ check whether the file system the script is on >is mounted with nosuid/nosgid.
Trvial check. But, while working on suidexec, I found another problem: recent Linuxes taint the stuff in the /proc file system. As long as real and effective uid/gid are different you can't access /proc/<pid>/fd. Only a setuid/exec pair cleans the "dumpable" flag, as it is called in the kernel. This means only setuid root programs would work.
I've gotten around it by using setuid() instead of seteuid(), but that means the real uid is gone (well saved in an environment variable ofcourse but still..). Also, when using "ps" you don't see the real name of the process anymore, but eg. "/bin/sh /proc/19445/fd/3" instead. To do better would require some kernel support.
Perhaps a more elegant (and portable!) solution would be to copy the script to, say, /var/spool/suidexec and then execute it as usual, bypassing the whole /proc/<pid>/fd stuff. Even "ps" would work again (and killall, etc).
I'll try to put something together that does just that, if anyone is interested.
Comments appreciated.
Mike. -- + Miquel van Smoorenburg + Cistron Internet Services + Living is a | | miquels@cistron.nl (SP6) | Independent Dutch ISP | horizontal | + miquels@drinkel.cistron.nl + http://www.cistron.nl/ + fall +
|  |