setuid programs don't seem to run setuid in TinyCore Linux

Question

I want to demonstrate the vulnerability of setuid programs using the TinyCore Linux live cd. That is, I craft a special program, with special permissions, so that it runs as the owner of the file instead of the executing user. These are my steps:

1. Create a program (see below) with a security hole, compile it in my home system (Ubuntu)

2. Make the program setuid and setup the owner of the file, still in Ubuntu

3. Unpack the Tiny Core live cd, copy the vulnerable program inside and chroot into it

The problem is the program doesn't seem to run as setuid. Neither in the chroot environment, nor in the completed remastered image. In Ubuntu it works, but I need it working in Tiny Core. The program runs in Tiny Core, but not as the owner, despite being setuid.

The program source code:

#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
  printf("Current time: ");
  fflush(stdout);
  system("date");
  return 0;
}

Command to build:

gcc -o prog prog.c

Make it setuid:

sudo chown 1200.1200 prog
sudo chmod 4755 prog

Craft a date script to demonstrate the vulnerability:

#!/bin/sh

echo hello > /tmp/test.txt
ls -l /tmp/test.txt

Make the crafted date script executable and expose the vulnerability:

chmod +x date
PATH=.:$PATH ./prog

In Ubuntu, as expected this creates /tmp/test.txt with owner 1200. But when I chroot to the live cd environment, it does not work there, the executable runs but not as the file owner. If I finish the remastering and create the live cd and boot into it, it does not work there either, even though the file has the right owner and group and permission 4755. What am I missing?

If you want to create the chroot environment, download the 8MB live cd from http://distro.ibiblio.org/tinycorelinux/downloads.html and follow these steps:

sudo mount Core-current.iso /mnt
mkdir /tmp/extract
cd /tmp/extract
zcat /mnt/boot/core.gz | sudo cpio -i -H newc -d

Copy the vulnerable programs to the chroot environment with:

sudo cp -a /path/to/prog /tmp/extract/tmp
sudo cp /path/to/date /tmp/extract/tmp

chroot in there and test the vulnerability:

sudo chroot /tmp/extract /bin/sh
su - tc
cd /tmp
PATH=.:$PATH ./prog

My end goal of course is to make it work on the live cd itself. It doesn't matter if it doesn't work in chroot, it just seems a suitable first test, without having to repack the image and booting into it.

Answer 1

Nothing wrong with setuid in TinyCore. However, the simple program in the question is not so simple to exploit in TinyCore.

The system call invokes the specified command using /bin/sh -c. In TinyCore, /bin/sh is a symlink to busybox ash, which drops setuid privileges. So even if you craft a shell script or even a binary that does something malicious and name it date to trick the vulnerable program to run it, it will not run as setuid. The original program will be running setuid, but not the command spawned by system.

As a side note, standard bash also drops setuid privileges when invoked as /bin/sh, ever since version 2. However, the vulnerability described in the question can be demonstrated in Debian and its derivatives, as apparently Debian's version of bash does not drop privileges. (Obviously there is a good reason for that but I did not research.)

Finally, I could circumvent the behavior of dropping privileges by changing the program to:

int main(int argc, char **argv)
{
  // circumvent busybox ash dropping privileges
  uid_t uid = geteuid();
  setreuid(uid, uid);

  printf("Current time: ");
  fflush(stdout);
  system("date");
  return 0;
}

Answer 2

Perhaps some security policy (SELinux, AppArmor, ...) is in force, and doesn't allow SUID to non-listed executables? Or is it just that (by sheer sanity) /tmp is mounted nosuid?