So this is a description of the system I'm working on :
- a "manager" process spawns all the other applications.
- The manager application runs as
root
user. - so now, any process that it spawns also inherit
root
user privileges.
The third point is clearly makes my application (let's call it 'player') a security risk so one solution would be to create a separate user and group, say 'worker' and then spawn the 'player' process as that user.
The specific implementation is as follows :
chown
the binary (player.out) to theworker
user and groupchown worker:worker player.out
- set the SUID bit on it with
chmod a+s player.out
.- this ensures that the process is started with (atleast) it's EUID set to 'worker'.
inside the application main use
setregid()
andsetreuid
to set the RUID to the same value as the EUID :if(setregid(getegid(), getegid()) != 0) {} if(setreuid(geteuid(), geteuid()) != 0) {}
My question is in two parts :
- Processes with SUID bit set are usually owned by
root
and are called setuid-applications to denote (possibly) that their permissions are elevated to root user irrespective of which user invoked the program.- is there any special name for binaries that use the SUID bit to automatically drop priveleges?
- Is there any other, better way to ensure that the 'player' application drops priveleges?
Edit : I should clarify that I have no control over the "manager" process that spawns the other processes. I only have control over my player
application.
exec su player -c 'exec /path/to/player "$@"' sh "$@"
orexec sudo -u player /path/to/player "$@"
, then you're sure it's done properly (includes setting all the supplementary groups) and you don't have to worry about the permissions of your setuid executable.