Sponsored Content
Top Forums Shell Programming and Scripting Setuid not working in Linux as script fails to write to file. Post 302826395 by alister on Wednesday 26th of June 2013 02:06:49 PM
Old 06-26-2013
Your analysis of the situation is incorrect, rbatte.

While you are correct that mount options can forbid suid binary executables (and even non-suid executables), linux does not support suid interpreted script executables, regardless of mount options.

Regards,
Alister

---------- Post updated at 02:06 PM ---------- Previous update was at 12:04 PM ----------

In case anyone is interested, a more detailed explanation.

Relevant functions from the 3.9.7 stable kernel:
fs/exec.c :: do_execve_common()
fs/exec.c :: prepare_binprm()
fs/exec.c :: search_binary_handler()
fs/binfmt_script.c :: load_script()

Linux can support many executable formats. Each format has a dedicated handler registered with the kernel. When loading an executable, the execve syscall must first identify the format of the executable. This is accomplished in search_binary_handler by walking the list of registered handlers until one of them succeeds. If none succeed, the system call fails.

This procedure can occur more than once. A typical, successful shell script execve requires two passes. The first pass ends with the success of load_script, the handler that recognizes the #! shebang header. This handler parses the interpreter's pathname from the shebang line and uses it to begin the second pass. Usually, the interpreter is a native binary (e.g. sh, awk, perl, etc), in which case this second handler search concludes with load_elf_binary.

The kernel calls prepare_binprm before each pass.

prepare_binprm resets the effective uid and gid to match that of the current process (execve's caller), before checking the inode of the executable it intends to load. If the inode's mode has a SUID/SGID bit set, then the euid/egid for the to-be-loaded executable is set to match the inode uid/gid (incidentally, rbatte, this is also where the NOSUID mount option check is located).

The first prepare_binprm call is in do_execve_common and involves the SUID shell script executable. The second call is in load_script and involves the interpreter pathname.

Between the two calls to prepare_binprm, the relevant data structure actually has the shell script owner's credentials, as if the kernel intends to allow the change in ownership. However, the second prepare_binprm invocation (just as the first) resets the euid/egid values to those of the current process. The shell script's inode's SUID/SGID change is clobbered and this time prepare_binprm consults the interpreter's inode, not the shell script's.

Regards,
Alister
This User Gave Thanks to alister For This Post:
 

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Need to write a home-grown backup script for Linux

I am researching ways in which to backup files or whole file systems for backup to another system. We are using Suse Linux 7.0 with no tape backup devices or secondary disks. What utilities would be the best to use for a simple yet flexible script for backup purposes? tar, cpio, compress. (3 Replies)
Discussion started by: darthur
3 Replies

2. Shell Programming and Scripting

log file when the script fails !

i have a script that will retrive some info from database. The script is working fine but i have to add new feature in it when the script fails or retrive null result it should reflect in the log file. below the script AMR_Inactive.sh while read i do connect1=`sqlplus -silent... (3 Replies)
Discussion started by: ali560045
3 Replies

3. IP Networking

read/write,write/write lock with smbclient fails

Hi, We have smb client running on two of the linux boxes and smb server on another linux system. During a backup operation which uses smb, read of a file was allowed while write to the same file was going on.Also simultaneous writes to the same file were allowed.Following are the settings in the... (1 Reply)
Discussion started by: swatidas11
1 Replies

4. UNIX for Advanced & Expert Users

when a process fails to write to /dev/log

Hi , when a process fails to write to /dev/log ? (1 Reply)
Discussion started by: Gopi Krishna P
1 Replies

5. UNIX for Dummies Questions & Answers

a problem with write a script in Linux version 2.4.27-ubnt0

Hello everyone, I have a radio wireless called UBNT Nanostation5 It has this linux OS:Linux version 2.4.27-ubnt0 When i want to write a script in ssh, i get some errors The script is: ifconfig eth0 down ifconfig eth0 hw ether 00:15:6D:**:**:** ifconfig eth0 up cfg -x echo... (1 Reply)
Discussion started by: cygol
1 Replies

6. Shell Programming and Scripting

Need help! command working ok when executed in command line, but fails when run inside a script!

Hi everyone, when executing this command in unix: echo "WM7 Fatal Alerts:", $(cat query1.txt) > a.csvIt works fine, but running this command in a shell script gives an error saying that there's a syntax error. here is content of my script: tdbsrvr$ vi hc.sh "hc.sh" 22 lines, 509... (4 Replies)
Discussion started by: 4dirk1
4 Replies

7. Red Hat

process fails if setuid bit is set

Hi, OS : Linux I have an executable (P1) owned by user say "abcd" and the setuid bit is set. And there is another executable (P2) which brings up the process (P1). When the setuid bit is set, the process P1 is failing, if the setuid bit is not set there is no issue. I was wondering if... (6 Replies)
Discussion started by: ahamed101
6 Replies

8. UNIX for Beginners Questions & Answers

Linux shell | how to exit a script if any command fails.

Hi, i am new here let me say HI for all. now i have a question please: i am sending one command to my machine to create 3 names. if one of the names exists then the box return error message that already have the name but will continue to create the rests. How i can break the command and... (7 Replies)
Discussion started by: Amiri
7 Replies

9. UNIX for Beginners Questions & Answers

What keeps me from abusing setuid(0) and programs with setuid bit set?

Just learning about the privilege escalation method provided by setuid. Correct me if I am wrong but what it does is change the uid of the current process to whatever uid I set. Right ? So what stops me from writing my own C program and calling setuid(0) within it and gaining root privileges ? ... (2 Replies)
Discussion started by: sreyan32
2 Replies
Test::Script(3) 					User Contributed Perl Documentation					   Test::Script(3)

NAME
Test::Script - Basic cross-platform tests for scripts DESCRIPTION
The intent of this module is to provide a series of basic tests for 80% of the testing you will need to do for scripts in the script (or bin as is also commonly used) paths of your Perl distribution. Further, it aims to provide this functionality with perfect platform-compatibility, and in a way that is as unobtrusive as possible. That is, if the program works on a platform, then Test::Script should always work on that platform as well. Anything less than 100% is considered unacceptable. In doing so, it is hoped that Test::Script can become a module that you can safely make a dependency of all your modules, without risking that your module won't on some platform because of the dependency. Where a clash exists between wanting more functionality and maintaining platform safety, this module will err on the side of platform safety. FUNCTIONS
script_compiles script_compiles( 'script/foo.pl', 'Main script compiles' ); The "script_compiles" test calls the script with "perl -c script.pl", and checks that it returns without error. The path it should be passed is a relative unix-format script name. This will be localised when running "perl -c" and if the test fails the local name used will be shown in the diagnostic output. Note also that the test will be run with the same perl interpreter that is running the test script (and not with the default system perl). This will also be shown in the diagnostic output on failure. script_runs script_runs( 'script/foo.pl', 'Main script runs' ); The "script_runs" test executes the script with "perl script.pl" and checks that it returns success. The path it should be passed is a relative unix-format script name. This will be localised when running "perl -c" and if the test fails the local name used will be shown in the diagnostic output. The test will be run with the same perl interpreter that is running the test script (and not with the default system perl). This will also be shown in the diagnostic output on failure. SUPPORT
All bugs should be filed via the bug tracker at <http://rt.cpan.org/NoAuth/ReportBug.html?Queue=Test-Script> For other issues, or commercial enhancement and support, contact the author. AUTHOR
Adam Kennedy <adamk@cpan.org> SEE ALSO
prove, <http://ali.as/> COPYRIGHT
Copyright 2006 - 2009 Adam Kennedy. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself. The full text of the license can be found in the LICENSE file included with this module. perl v5.16.3 2009-11-24 Test::Script(3)
All times are GMT -4. The time now is 06:34 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy