Hot answers tagged

6

As @schily says, in the ping utilility (and others), the root permissions are dropped after they are no longer necessary. This is done for security reasons. From ping.c - main() - the user is dropped with the getuid and setuid call. getuid() gets the current user, and root doing a setuid() will change the uid of the process. /* * Pull this stuff up front ...


3

The uid of the second process has been reset already because there is no need to be root anymore after the sockets have been opened. The passwd utility still needs root privileges when you checked. If you like to verify this, you will need to check the source-code as the reset of the uid may be done too fast to give others a chance to verify the uid before ...


3

The general sense of @rui-f-ribeiro remark is correct, but the details are not. Details matter. Ubuntu uses these packages: iputils-ping passwd The ping utility resets permissions in a function named limit_capabilities, shared by ping and ping6. The relevant chunk of code looks like this: if (prctl(PR_SET_KEEPCAPS, 1) < 0) { ...


2

Chroot is the more traditional way of doing this, and you can make it work, but since you're doing this via a web interface, it gets a little complicated: you must prevent race conditions (multiple users from using the same chroot environment), you must dynamically build a directory structure for each request, and probably a few other things I can't think of ...


1

I think I can improve on the answer given by EightBitTony. ssh -t user@target 'sudo cat /source/file' > output && chmod +x output When more than one file is involved, I find pax much easier to use than rsync, not matter how often rsync is "simplified" for me. ssh -t user@target 'cd /src && pax -w ./' | pax -r HTH.


1

You should remove from the password file the which word... It should be something like : root:x:0:0:root:/root:/bin/zsh Where /bin/zsh is the path to the Z shell binary. In the current config, the login process is trying to execute which zsh and that command is failing. Also, edit the file as root, with sudo vim /etc/passwd for example because it is ...


1

SystemTap 3 lines, problem solved, SystemTap completely rules: Install SystemTap, create ptysnoop file: #!/usr/bin/stap probe kernel.function("pty_write") { if (kernel_string($tty->name) == @1) { printf("%s", kernel_string_n($buf, $c)) } } Make it executable. Now to watch /dev/pts/6 you just: $ sudo ptysnoop pts6 Edit: other ...


1

You can specify multiple file descriptors for peekfd. e.g. peekfd -n -8 -d -c 24184 0 1 2 will snoop on stdin, stdout, and stderr of pid 24184. The -c option will also attach to any child processes. This is necessary in order to see the ouput from them (e.g. seeing the output of ls that has been run in a snooped-on shell process) Strangely, I find ...


1

Start another Linux VM, and mount that disk to repair the problem. In addition, to avoid the password entered in single user mode, change as follows /lib/systemd/system/rescue.service. --- /lib/systemd/system/rescue.service.orig 2015-11-20 13:49:03.000000000 +0900 +++ /lib/systemd/system/rescue.service 2016-04-11 15:58:31.002000000 +0900 @@ -18,11 ...



Only top voted, non community-wiki answers of a minimum length are eligible