4

Suppose I change some user settings like its initial login group or add it to a new group. I now can do su user and work with these new settings. But all the previously running processes will still have the same permissions as before.

How can I force a specific running process to re-read /etc/passwd and /etc/group to reinitialize its user and group settings, without terminating any activity it was doing? I've tried attaching to the process with gdb and do print setuid(MY_USER_ID), but despite the result was 0 (i.e. success), the process still remained with the same data (checked on bash running groups to see whether additional group has appeared).

2

Very interesting attempt. Actually, process's supplementary groups (defined in /etc/group) are set by setgroups system call. It requires CAP_SETGID privilege or being root.

So you can do like this:

# id
uid=0(root) gid=0(root) groups=0(root)

# gdb -q id
Reading symbols from id...(no debugging symbols found)...done.
(gdb) b getgroups
Breakpoint 1 at 0x401990
(gdb) run
Starting program: /usr/bin/id 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Breakpoint 1, getgroups () at ../sysdeps/unix/syscall-template.S:81
81  ../sysdeps/unix/syscall-template.S: No such file or directory.
(gdb) call setgroups(5, {1, 2, 3, 4, 5})
$1 = 0
(gdb) d 1
(gdb) c
Continuing.
uid=0(root) gid=0(root) groups=0(root),1(daemon),2(bin),3(sys),4(adm),5(tty)
[Inferior 1 (process 8059) exited normally]
(gdb) 
  • But this wouldn't work for a non-root process, right? Does a process have to become root first to reinit its groups? – Ruslan Jun 10 '15 at 4:51
  • @Ruslan Yes, therefore you need to start another session for group changes to take effect, and /usr/bin/newgrp is a setuid command. – yaegashi Jun 10 '15 at 5:09
2

Seems like a rather pointless exercise.

Target process not only may not have all rights necessary to switch credentials, it may have its uid/gid stored somewhere and actively used, so a surprise credential change may actually break things.

There are various entities which know who owns them - files, sysv ipc.

So you would need to /stop/ all target processes and updated all possible places.

But some processes may be blocked in an uninterruptible manner in the kernel - now what?

For toy purposes, you would need a kernel module changing credentials for processes, but even that cannot easily deal with blocked processes.

Or in other words: what are you really trying to accomplish and why?

  • Actually what I want to accomplish doesn't depend on what the process does with its uid/gid etc. I'm just trying to grant/deny it some permission from now on, but not having to stop the process, which may be in the middle of something (not in disk sleep anyway) or whatever. – Ruslan Jun 10 '15 at 9:09
  • In that case you want to investigate LSM modules instead. – employee of the month Jun 12 '15 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.