0

I sometimes have the need to change my UID to arbitrary value when testing user namespace functionality.

Currently, I do something like:

useradd -u <uid> testuser
su testuser
userdel testuser

I first need add the user in order to su, since su doesn't accept an arbitrary UID, but only a valid username found in /etc/passwd?

Do any of the common Linux utilities allow changing to arbitrary UID given CAP_SETUID?

NB: I know I could compile a small setuid(2) application, but it's cumbersome to transfer it into e.g. containers everytime I want to test user namespace functionality.

3
  • At the end you mention "containers". Why can't you just leave a test user inside the container for this purpose? Why do you need to tear it down every time? I ask because this seems like a bad idea generally. – Philip Couling Jan 11 at 10:26
  • @PhilipCouling - it's because I work as a penetration tester, primarily focusing on cloud, so I have some methods of working that don't reflect normal usage – Shuzheng Jan 11 at 11:05
  • It's better to make this sort of this explicit to avoid tripping up future readers. What's your requirement: to get a process running without matching user entry, or to run as a different user without the overhead of setup / tear down? – Philip Couling Jan 11 at 11:13
1

It's not really clear exactly what you're trying to achieve. From your question you might be:

  • Attempting to execute something as a different user for testing without the overhead of creating that user every time
  • Attempting to run a process as a user that doesn't exist (with not matching entry in /etc/passwd or more precisely with getent passwd)
  • Attempting to test the behaviour of CAP_SETUID

If either of the first two then you could just create an executable with setuid and setgid bits set and set the executable user and group to an arbitary number. You don't even need to compile your own executable, just copy an existing one.

As root:

mkdir test_dir
# Secure the directory to prevent tampering by other users
chmod go-rx test_dir 
cd test_dir

cp $(which bash) .

# arbitrary user 1997  group 1998
chown 1997:1998 ./bash
chmod ug+s ./bash
chmod go+rx ./bash

# Run touch as an arbitrary user
./bash -p -c `touch /tmp/test_file`

# Check the result
ls -lh /tmp/test_file
-rw-r----- 1 1997 1998 0 Jan 11 08:22 /tmp/test_file

Additionally python (a scripting programming language) is available on many platforms. You could write a very short python script to run something after calling setuid and setgid:

eg uid.py:

import os
import sys
import subprocess

# Set uid and gid
os.setuid(int(sys.argv[1]))
os.setgid(int(sys.argv[2]))

# Run the given command, passing in remaining arguments.
subprocess.run(*sys.argv[3:])

Then, with CAP_SETUID given to python you could:

python setuid.py 1997 1998 touch /tmp/test_file

This will have the same effect of running touch with uid 1997 and gid 1998.

Note that python scripts do not need to be created as files they can be passed inline: https://stackoverflow.com/a/16938013/453851

2
  • @user414777 I wrote it without testing, but the principle is sound enough. – Philip Couling Jan 11 at 15:55
  • @PhilipCouling — thank you. Indeed, I’m interested in the first two scenarios, since I need to chance my UID from inside a container to match a UID outside the container, without an entry for that user present in the container’s /etc/passwd. While you show me how to achieve that using custom methods, I was really hoping for a solution like su <uid> in order to login as that UID. I see there’s no standard Linux utility supporting that. – Shuzheng Jan 11 at 18:34
0

Do any of the common Linux utilities allow changing to arbitrary UID given CAP_SETUID?

No, they don't.

I know I could compile a small setuid(2) application, but it's cumbersome to transfer it into e.g. containers everytime I want to test user namespace functionality.

If you plan to do your testing framework in bash, everything will be "cumbersome", to say the least.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.