I wonder that an SUID program like
passwd is using the
setuid() function call. Why does it drop root privileges?
Against what types of attack does this help? Buffer-overflow?
First I'll discuss the setuid bit, which passwd uses and is distinct from the
It is not a protection against a buffer overflow, it's vunerable to such, or basically anything which would allow an attacker to use a privileged process for some nefarious unintended purpose. This is because the setuid bit is the opposite of "dropping privileges"; it bestows root privileges, but only to the process and not the actual user. That includes
That form of setuid requires the filesystem setuid bit set on the executable;
So using setuid in that sense is not protection against anything, but it is often discussed in relation to vulnerabilities because potential vunerabilities are very important WRT setuid executables.
BUT: the setuid bit sets the euid and not the actual uid, so it is actually parallel to the
There is an opposite form of "setuid" that is about dropping privileges, which involves the actual
It's simply a preventative measure. Any app could potentially be vulnerable to any exploit conceivable if miscoded. The trick to reducing the possible damage is to perform actions with the least privileges required. Dropping running as root when not needed is an excellent start.