2

I understand that we probably cannot do ptrace on suid binaries. However, I'm wondering why we cannot do ptrace after the binary drops its previlege to uid instead of euid.

For example, in the binary the suid binary drops privilege after some steps.

 seteuid (euid);
 ret_chdir = chdir (path);
 seteuid (ruid);

 system("whoami");
 printf("Enter any char");
 scanf("%c", &junk);

In my case when "whoami" is printed, it is the user name of the process but not the owner of the process. When the program is waiting for a junk input, I was trying to attach to the running process with the uid as the user name, but it failed even though the binary had dropped the privilege. Is it possible that ptrace attach uses the saved-uid state to decide that I'm not the owner?

1

Your example code does not drop privileges! It can freely elevate privileges again by calling seteuid(euid). If you can ptrace it then you can make it call seteuid(euid) and thus execute privileged code.

Are you asking this because you thought ptrace was read-only? No, it isn't: strace is just one thing you can do with it; ptrace allows the tracer to execute arbitrary code in the tracee, not just observe. There's no fine-grained access control that grants “read-only” ptrace access.

But even a read-only ptrace is dangerous. An application that has had elevated privileges might be manipulating confidential data. So you can't ptrace a process that has been privileged, even if it's dropped privileged. The process has to call execve to drop all traces of having been privileged.

  • Got a source to back up execve()? I can verify that it is currently true but I went looking for the rule and couldn't find it at all. – Joshua Nov 6 '18 at 4:17
0

That seems a good guess, because of the possibility of switching back, which is a known area where a security problem would result.

Further reading:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.