Why ssh-agent group ownership is not root

Question

Trying to understand why ssh-agent has sgid bit and found this post ssh-agent has sgid

I have another question, why the group ownership of ssh-agent is nobody not root? What is the reason behind it? Will it still work if group ownership is root?

Answer 1

If it were setgid root then the agent would run as group root, which likely has broader permissions than the user it started as. That could be a security risk; at the least, running something as root unnecessarily is a red flag (even the group) and requires extra attentiveness.

Setting the group ownership to nobody, which is a group that shouldn't have any meaningful permissions or files attached, means that ssh-agent doesn't get any more rights than the user started with. As the linked question says, the reason it's setgid in the first place is to prevent ptracing the program, rather than because it actually needs different permissions. In the discussion thread linked from the other question, one of the developers notes:

it would seem that the group is of no consequence. It's the fact that the binary is setgid anygroup that's important.

nobody is a handy group to use when you only want a side effect of setgid, not the behaviour itself.

I imagine it would still work with setgid root. I just tried that here, and it didn't complain at all and seemed to work in cursory testing. That said, I can't think of any actual reason to change it to that - everyone seems to be better off with it running as group nobody than group root.

I don't suggest changing the permissions of files installed by your package manager, in any case, because they tend to get upset about any modifications to the files they control.

Answer 2

The point of making ssh-agent setgid is to increase security by making the process impossible to debug, so that even a process running as the same user can't dump keys from memory.

ssh-agent should not in fact have additional privileges. In case there is a vulnerability in ssh-agent, if it is setgid to some group, this confers the user the privileges of that group. Running ssh-agent setgid therefore increases the security risk… unless the group that ssh-agent runs as has in fact no privileges whatsoever — in particular, no write permission on any file.

The best way to run a program setgid without having an impact on other programs is to use a dedicated group. That's what Debian does, for example: ssh-agent runs as the group ssh. Fedora uses the group nobody, which is dodgier but still ok as no file should ever be owned by the group nobody. The group root would be a bad idea because it owns a lot of files.