Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to demonstrate the vulnerability of setuid programs using the TinyCore Linux live cd. That is, I craft a special program, with special permissions, so that it runs as the owner of the file instead of the executing user. These are my steps:

  1. Create a program (see below) with a security hole, compile it in my home system (Ubuntu)

  2. Make the program setuid and setup the owner of the file, still in Ubuntu

  3. Unpack the Tiny Core live cd, copy the vulnerable program inside and chroot into it

The problem is the program does not seem to run as setuid neither in the chroot environment, nor in the completed remastered image. In Ubuntu it works, but I need it working in Tiny Core. The program does run in Tiny Core, but even though it has setuid permissions, it is not running as the owner of the file.

The program source code:

#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
  printf("Current time: ");
  fflush(stdout);
  system("date");
  return 0;
}

Build it:

gcc -o prog prog.c

Make it setuid:

sudo chown 1200.1200 prog
sudo chmod 4755 prog

Craft a date script to demonstrate the vulnerability:

#!/bin/sh

echo hello > /tmp/test.txt
ls -l /tmp/test.txt

Make the crafted date script executable and expose the vulnerability:

chmod +x date
PATH=.:$PATH ./prog

In Ubuntu, as expected this creates /tmp/test.txt with owner 1200. But when I chroot to the live cd environment, it does not work there, the executable runs but not as the file owner. If I finish the remastering and create the live cd and boot into it, it does not work there either, even though the file has the right owner and group and permission 4755. What am I missing?

If you want to create the chroot environment, download the 8MB live cd from http://distro.ibiblio.org/tinycorelinux/downloads.html and follow these steps:

sudo mount Core-current.iso /mnt
mkdir /tmp/extract
cd /tmp/extract
zcat /mnt/boot/core.gz | sudo cpio -i -H newc -d

Copy the vulnerable programs to the chroot environment with:

sudo cp -a /path/to/prog /tmp/extract/tmp
sudo cp /path/to/date /tmp/extract/tmp

chroot in there and test the vulnerability:

sudo chroot /tmp/extract /bin/sh
su - tc
cd /tmp
PATH=.:$PATH ./prog

My end goal of course is to make it work on the live cd itself. It doesn't matter if it doesn't work in chroot, it just seems a suitable first test, without having to repack the image and booting into it.

share|improve this question

migrated from serverfault.com Feb 20 '13 at 16:32

This question came from our site for professional system and network administrators.

    
Does the user owning the setuid program exist within the chrooted environment or only in the "main" environment? –  Jenny D Feb 20 '13 at 8:20
    
It doesn't have to. If you try the above steps it should work in any Linux system, and when you run PATH=.:$PATH ./prog, the file /tmp/test.txt will be created and owned by uid=1200, even if it does not exist. –  janos Feb 20 '13 at 11:49
1  
Is the CD mounted with the nosuid option? –  Celada Feb 20 '13 at 19:00
    
I don't execute anything from a mounted CD. While remastering the CD, the chroot directory is on a regular filesystem not a CD mount. When booting into the completed remastered live CD, the files are on the root filesystem, which is NOT mounted with nosuid. –  janos Feb 20 '13 at 19:08

2 Answers 2

Perhaps some security policy (SELinux, AppArmor, ...) is in force, and doesn't allow SUID to non-listed executables? Or is it just that (by sheer sanity) /tmp is mounted nosuid?

share|improve this answer
    
The live CD I use is tiny, 8MB to begin with. I doubt it would be that sophisticated, but maybe you're right, I should check on this (not sure how...). As per /tmp, I used that only to simplify the question. In my real setup it's in my home directory, not mounted nosuid. In fact, the vulnerability test works in the native environment, then I chroot into it there it doesn't. –  janos Feb 20 '13 at 19:14
up vote 1 down vote accepted

Nothing wrong with setuid in TinyCore. However, the simple program in the question is not so simple to exploit in TinyCore.

The system call invokes the specified command using /bin/sh -c. In TinyCore, /bin/sh is a symlink to busybox ash, which drops setuid privileges. So even if you craft a shell script or even a binary that does something malicious and name it date to trick the vulnerable program to run it, it will not run as setuid. The original program will be running setuid, but not the command spawned by system.

As a side note, standard bash also drops setuid privileges when invoked as /bin/sh, ever since version 2. However, the vulnerability described in the question can be demonstrated in Debian and its derivatives, as apparently Debian's version of bash does not drop privileges. (Obviously there is a good reason for that but I did not research.)

Finally, I could circumvent the behavior of dropping privileges by changing the program to:

int main(int argc, char **argv)
{
  // circumvent busybox ash dropping privileges
  uid_t uid = geteuid();
  setreuid(uid, uid);

  printf("Current time: ");
  fflush(stdout);
  system("date");
  return 0;
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.