lkml.org 
[lkml]   [1996]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: setuid scripts (was Re: proc fs and shared pids)
Date
In article <96Sep17.061459+0100met_dst.2333-25720+40@work.smurf.noris.de>,
Matthias Urlichs <smurf@smurf.noris.de> wrote:
>In linux.dev.kernel, article <Pine.LNX.3.95.960906174146.31788A-100000@xarius.demon.co.uk>,
> Darren J Moffat <darren@xarius.demon.co.uk> writes:
>>
>> $ setuidexec /bin/sh
>> Syntax error while executing setuidexec
>> Usage: #! setuidexec <shell>
>>
>> The reason for this is the setuidexec program (as posted in this list)
>> does the /dev/fd hack that Solaris 2.x does exactly _and_ checks the
>> permisons of the script _and_ creates a minimal standard environment _and_
>> can't be run unless it is called via a #! mechanism.
>
>But the only way to check the latter is via looking at argv[]. Thus, this
>check can be defeated by calling suidexec with a trivial C wrapper.

Yep. You are right there. I posted the suidexec wrapper, so I tried to
fix it.

>Nonono... setuidexec _must_ check whether the file system the script is on
>is mounted with nosuid/nosgid.

Trvial check. But, while working on suidexec, I found another problem:
recent Linuxes taint the stuff in the /proc file system. As long as
real and effective uid/gid are different you can't access /proc/<pid>/fd.
Only a setuid/exec pair cleans the "dumpable" flag, as it is called in
the kernel. This means only setuid root programs would work.

I've gotten around it by using setuid() instead of seteuid(), but that
means the real uid is gone (well saved in an environment variable
ofcourse but still..). Also, when using "ps" you don't see the real
name of the process anymore, but eg. "/bin/sh /proc/19445/fd/3" instead.
To do better would require some kernel support.

Perhaps a more elegant (and portable!) solution would be to copy the script
to, say, /var/spool/suidexec and then execute it as usual, bypassing the
whole /proc/<pid>/fd stuff. Even "ps" would work again (and killall, etc).

I'll try to put something together that does just that, if anyone is
interested.

Comments appreciated.

Mike.
--
+ Miquel van Smoorenburg + Cistron Internet Services + Living is a |
| miquels@cistron.nl (SP6) | Independent Dutch ISP | horizontal |
+ miquels@drinkel.cistron.nl + http://www.cistron.nl/ + fall +

\
 
 \ /
  Last update: 2005-03-22 13:37    [W:0.116 / U:0.368 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site