All Questions

Tagged with
Filter by
Sorted by
Tagged with
8
votes
2answers
682 views

Why does the setuid bit work inconsistently?

I wrote the code: // a.c #include <stdlib.h> int main () { system("/bin/sh"); return 0; } compiled with command: gcc a.c -o a.out added setuid bit on it: sudo chown root.root a.out sudo ...
7
votes
1answer
248 views

Root privileges can be restored after setuid(1000) in musl libc

musl libc allows you to change uid to root even after supposedly dropping permissions with setuid(1000). I am not able to reproduce the problem with glibc. Code: #define _GNU_SOURCE #include <...
1
vote
4answers
84 views

How to securely sanitize permissions for a subtree

On our server, there are multiple (currently two, expected three or four) users allowed to deploy a new version of our application. This process consists of downloading a few files from a trusted ...
3
votes
1answer
217 views

suid executibles work only when present in the system PATH

I have an executible which requires root privilages. But it seems to work only when it's present in the system path. When I execute it like this: $ ./prog The program complains of having no root ...
2
votes
2answers
668 views

ptrace suid binaries after privilege is dropped

I understand that we probably cannot do ptrace on suid binaries. However, I'm wondering why we cannot do ptrace after the binary drops its previlege to uid instead of euid. For example, in the binary ...
6
votes
3answers
1k views

What exactly differentiates the root user from every other user?

What are the fundamental differences between some arbitrary account and root? Is it just the UID being something other than zero? So, what exactly does the su binary do and how does it elevate a user ...
1
vote
2answers
54 views

User verification

Suppose I've writen a setuid root executable and I want it to verify that the user is not a script by asking the user to provide his/her password (granted, users might save their password and use that ...
4
votes
1answer
745 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
3
votes
1answer
259 views

Why isn't 'nethogs' installed with the setuid bit set?

I've been using nethogs for a while now, having to sudo every time, while ping has the setuid bit set. Today I set it for nethogs and it works: $ ls -l $(which nethogs) $(which ping) -rwxr-xr-x 1 ...
1
vote
0answers
109 views

Limit program execution to a list of arguments

I would like that my Unix users can only run a specific command insecurecommand with a controlled list of arguments stored in a file. The only solution I have found at this time is to : Create a new ...
4
votes
2answers
1k views

using SUID bit to drop privileges

So this is a description of the system I'm working on : a "manager" process spawns all the other applications. The manager application runs as root user. so now, any process that it spawns also ...
6
votes
3answers
1k views

Under what scenarios would I want to set a SUID bit?

I'm struggling to wrap my mind around the concept of SUID bits and why they're would be useful. For example, let's say I have a program: -rwsr-xr-x 1 root root 12364 Jan 12 2013 /usr/bin/...
6
votes
1answer
829 views

How does having /dev/fd make running shell scripts under sudo safe?

At the end of the man page for sudo, there's the following remark: Running shell scripts via sudo can expose the same kernel bugs that make setuid shell scripts unsafe on some operating systems ...
26
votes
1answer
997 views

What would be the best way to work around this glibc problem?

I administer a Gentoo Hardened box that uses file capabilities to eliminate most of the need for setuid-root binaries (e.g. /bin/ping has CAP_NET_RAW, etc). Infact, the only binary I have left is ...
2
votes
2answers
1k views

setuid programs don't seem to run setuid in TinyCore Linux

I want to demonstrate the vulnerability of setuid programs using the TinyCore Linux live cd. That is, I craft a special program, with special permissions, so that it runs as the owner of the file ...
6
votes
2answers
4k views

Purpose of using setuid() in SUID programs

I wonder that an SUID program like passwd is using the setuid() function call. Why does it drop root privileges? Against what types of attack does this help? Buffer-overflow?
2
votes
3answers
3k views

SUID permissions - Which is correct?

Trying to secure a Linux server and have little experience with SUID. After executing find / -perm +4000 many programs were discovered. I have seen conflicting advice here and here on what should ...
5
votes
1answer
3k views

How to replace setuid with file-system capabilities

Inspired by this question here is the follow-up: As some of you may know setuid-binaries are dangerous, since some exploits use these to escalate their rights up to root. Now it seems that there has ...
12
votes
1answer
4k views

root owned program with setuid bit on

Ping is a a program owned by root with the user id bit set. $ ls -l `which ping` -rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping As I understand it, if a user runs the ping process, then the ...
6
votes
2answers
3k views

Why is mount.cifs not installed suid by default?

I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that mount....
182
votes
8answers
136k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...