I set my SETUID bit to a non-root user so that the process should take the ownership of that executable file always. But I figured out setuid bit can be changed back to RUID within the script itself.
Is there any way to prevent it so that setuid bit can not be changed back to its original user id ?
I tried the below experiment.
chown 1000 /usr/local/bin/php chmod u+s /usr/local/bin/php
<?php echo "RUID: " . posix_getuid() . "\n"; echo "EUID: " . posix_geteuid() . "\n"; echo file_put_contents('/root/euid_root.txt', 'test'); echo "\n\n"; // return EUID to root // a process can change it's EUID back to RUID/SUID posix_seteuid(0); echo "RUID: " . posix_getuid() . "\n"; echo "EUID: " . posix_geteuid() . "\n"; echo file_put_contents('/root/uid_apache.txt', 'test'); echo "\n";
RUID: 0 EUID: 1000 PHP Warning: file_put_contents(/root/euid_apache.txt): failed to open stream: Permission denied in /root/test.php on line 17 RUID: 0 EUID: 0 4