4

I've read the section in man bash explaining the set builtin's -p flag, and this tells me a few of the effects that privileged mode has on Bash's behavior, but it doesn't explain in enough depth (or I just don't have enough context/experience) for me to understand the purpose it serves, i.e. in what situations you would use it.

Part of my confusion comes from the fact that everything I read about privileged mode makes it sound like "under-privileged" would be a more appropriate name. This in itself is probably an indicator that I'm misunderstanding something about it.

I'm also not sure I understand setuid. I'm familiar with effective user id and real user id as it relates to sudo, but it sounds like setuid is a broader concept, so maybe I'm missing something.

5

Privileged mode exists to try to increase security (by restricting potentially dangerous actions) when the shell is running under augmented privileges, such as invoked by a setuid program.

Yes, you are correct in that it sounds like "under-privileged", the -p option is restricting actions that could potentially allow an attack, by perhaps tricking the shell to execute commands under a more privileged user. For instance, that's why it restricts startup scripts, since those might not be owned or controlled by the privileged user in that situation. Also, inheriting functions from the environment can also be dangerous, since one could export a function such as cd or ls that might be used during the privileged shell and then trigger an action that can be used for an attack.

You also asked about "setuid". In this context, "setuid" usually refers to the permissions of binaries that includes the 04000 bit, for example permission 04711 (or -rws--x--x in ls output.) Enabling the "setuid" bit in a binary makes it always run under the effective uid of the owner of that binary. So a setuid binary owned by root will run as root whenever any user executes it. The real uid will be that of the user who invokes it, that's why the effective uid != real uid check is common in this situation. (BTW, the same exists for "setgid" bit, which is 02000 in file permissions.)

So one likely scenario where bash -p can be used is a setuid binary which runs as a privileged user (root or otherwise) and wants to spawn a shell, they might use bash -p for that scenario, since then bash will try to stay more secure (by ignoring startup scripts and functions from the environment, which might be dangerous) and will keep the permissions of the effective uid while running. Invoking it without the -p option means bash will simply ignore the effective uid (by resetting to the real uid) and behave as if nothing had happened...

There are still many security pitfalls here... So using a privileged bash still requires a lot of thought on how security might be impacted. The measures taken by -p might help, but need to be considered in the whole context of possible attack scenarios.

  • 1
    It has been almost 4 years since Shellshock. I think that we don't need to qualify inheriting functions from the environment can also be dangerous with might be s and could s any more. (-: – JdeBP Apr 21 '18 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.