Messages in this thread | | | Date | Tue, 29 Nov 2005 21:35:45 -0500 | From | David Chau <> | Subject | Why can setuid programs regain root after dropping it when using capabilities? |
| |
Hi,
While debugging some code, I found that a setuid program could regain root after dropping root if the program used capabilities. (I tested this on 2.6.14 and 2.6.9.) Is this the expected behavior? Here's a short test case:
/* chown root this program, suid it, and run it as non-root */ #include <sys/types.h> #include <sys/capability.h> #include <unistd.h> #include <stdio.h> int main() { cap_set_proc(cap_from_text("all-eip")); /* drop all caps */ setuid(getuid()); /* drop root. this call succeeds */ setuid(0); /* this should fail! but doesn't */ printf("%d\n", geteuid()); /* we regained root. prints 0 */ return 0; }
(If we don't use capabilities at all, and take out the cap_set_proc line, then the program behaves as expected, and doesn't allow us to regain root.)
--David - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |