Is there any way to augment privileges for your process? Here's an example: Pretend program A was compiled in C with only user-mode privileges. Now let's just say this program wanted to get root privileges but it needed the user name and password for root. So it called upon a macro, or library that then requested the user name, and password. If the user name, or password was incorrect it returned a error, but if the user name, and password were correct it would grant the process root privileges.
This is not possible. Not because there's no function in C, but because the Unix security model forbids it.
Under the Unix security model, a program can only reduce its privileges, it can never increase its privileges. A process can temporarily reduce its effective privileges, and regain its original “real” privileges later, but it can never go further up than where it started.
A process that logs users in must start with root privileges, i.e. with the right to do everything. Once the user has entered their name and password and the login program has verified them, the process permanently changes to the desired user. It can get the root privileges in either of two ways:
- It can be started by another process that is running as root. This is how console login and SSH login work.
- It can be a setuid executable belonging to root. This is how
I've simplified some things here, but the fundamental principle that a program cannot increase its privileges is always true. There is only one way in which a process can gain privileges, and that's by executing a setuid¹ executable.
If a program needs to execute some tasks with higher privileges, it won't be able to do it by itself. It must get a higher-privileges process to do it. It can do this either by contacting an already-running server that runs with the desired privileges, or by running a setuid executable. The setuid executable can be something like
sudo which in turn runs an executable that doesn't have any special permissions, but if there is privilege elevation, there has to be a setuid executable in the chain.
¹ or setgid, setpcap…