Setuid not working in Linux as script fails to write to file. Post: 302826395

Sponsored Content

Top Forums Shell Programming and Scripting Setuid not working in Linux as script fails to write to file. Post 302826395 by alister on Wednesday 26th of June 2013 02:06:49 PM

06-26-2013

Registered User

Your analysis of the situation is incorrect, rbatte.

While you are correct that mount options can forbid suid binary executables (and even non-suid executables), linux does not support suid interpreted script executables, regardless of mount options.

Regards,
Alister

---------- Post updated at 02:06 PM ---------- Previous update was at 12:04 PM ----------

In case anyone is interested, a more detailed explanation.

Relevant functions from the 3.9.7 stable kernel:
fs/exec.c :: do_execve_common()
fs/exec.c :: prepare_binprm()
fs/exec.c :: search_binary_handler()
fs/binfmt_script.c :: load_script()

Linux can support many executable formats. Each format has a dedicated handler registered with the kernel. When loading an executable, the execve syscall must first identify the format of the executable. This is accomplished in search_binary_handler by walking the list of registered handlers until one of them succeeds. If none succeed, the system call fails.

This procedure can occur more than once. A typical, successful shell script execve requires two passes. The first pass ends with the success of load_script, the handler that recognizes the #! shebang header. This handler parses the interpreter's pathname from the shebang line and uses it to begin the second pass. Usually, the interpreter is a native binary (e.g. sh, awk, perl, etc), in which case this second handler search concludes with load_elf_binary.

The kernel calls prepare_binprm before each pass.

prepare_binprm resets the effective uid and gid to match that of the current process (execve's caller), before checking the inode of the executable it intends to load. If the inode's mode has a SUID/SGID bit set, then the euid/egid for the to-be-loaded executable is set to match the inode uid/gid (incidentally, rbatte, this is also where the NOSUID mount option check is located).

The first prepare_binprm call is in do_execve_common and involves the SUID shell script executable. The second call is in load_script and involves the interpreter pathname.

Between the two calls to prepare_binprm, the relevant data structure actually has the shell script owner's credentials, as if the kernel intends to allow the change in ownership. However, the second prepare_binprm invocation (just as the first) resets the euid/egid values to those of the current process. The shell script's inode's SUID/SGID change is clobbered and this time prepare_binprm consults the interpreter's inode, not the shell script's.

Regards,
Alister

This User Gave Thanks to alister For This Post:

alister

View Public Profile for alister

Find all posts by alister

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Need to write a home-grown backup script for Linux

I am researching ways in which to backup files or whole file systems for backup to another system. We are using Suse Linux 7.0 with no tape backup devices or secondary disks. What utilities would be the best to use for a simple yet flexible script for backup purposes? tar, cpio, compress.

2. Shell Programming and Scripting

log file when the script fails !

i have a script that will retrive some info from database. The script is working fine but i have to add new feature in it when the script fails or retrive null result it should reflect in the log file. below the script AMR_Inactive.sh while read i do connect1=`sqlplus -silent...

3. IP Networking

read/write,write/write lock with smbclient fails

Hi, We have smb client running on two of the linux boxes and smb server on another linux system. During a backup operation which uses smb, read of a file was allowed while write to the same file was going on.Also simultaneous writes to the same file were allowed.Following are the settings in the...

4. UNIX for Advanced & Expert Users

when a process fails to write to /dev/log

Hi , when a process fails to write to /dev/log ?

5. UNIX for Dummies Questions & Answers

a problem with write a script in Linux version 2.4.27-ubnt0

Hello everyone, I have a radio wireless called UBNT Nanostation5 It has this linux OS:Linux version 2.4.27-ubnt0 When i want to write a script in ssh, i get some errors The script is: ifconfig eth0 down ifconfig eth0 hw ether 00:15:6D:**:**:** ifconfig eth0 up cfg -x echo...

6. Shell Programming and Scripting

Need help! command working ok when executed in command line, but fails when run inside a script!

Hi everyone, when executing this command in unix: echo "WM7 Fatal Alerts:", $(cat query1.txt) > a.csvIt works fine, but running this command in a shell script gives an error saying that there's a syntax error. here is content of my script: tdbsrvr$ vi hc.sh "hc.sh" 22 lines, 509...

7. Red Hat

process fails if setuid bit is set

Hi, OS : Linux I have an executable (P1) owned by user say "abcd" and the setuid bit is set. And there is another executable (P2) which brings up the process (P1). When the setuid bit is set, the process P1 is failing, if the setuid bit is not set there is no issue. I was wondering if...

8. UNIX for Beginners Questions & Answers

Linux shell | how to exit a script if any command fails.

Hi, i am new here let me say HI for all. now i have a question please: i am sending one command to my machine to create 3 names. if one of the names exists then the box return error message that already have the name but will continue to create the rests. How i can break the command and...

9. UNIX for Beginners Questions & Answers

What keeps me from abusing setuid(0) and programs with setuid bit set?

Just learning about the privilege escalation method provided by setuid. Correct me if I am wrong but what it does is change the uid of the current process to whatever uid I set. Right ? So what stops me from writing my own C program and calling setuid(0) within it and gaining root privileges ? ...

LEARN ABOUT DEBIAN

git-ls-remote

GIT-LS-REMOTE(1)						    Git Manual							  GIT-LS-REMOTE(1)

NAME

       git-ls-remote - List references in a remote repository

SYNOPSIS

       git ls-remote [--heads] [--tags]  [-u <exec> | --upload-pack <exec>]
		     [--exit-code] <repository> [<refs>...]

DESCRIPTION

       Displays references available in a remote repository along with the associated commit IDs.

OPTIONS

       -h, --heads, -t, --tags
	   Limit to only refs/heads and refs/tags, respectively. These options are not mutually exclusive; when given both, references stored in
	   refs/heads and refs/tags are displayed.

       -u <exec>, --upload-pack=<exec>
	   Specify the full path of git-upload-pack on the remote host. This allows listing references from repositories accessed via SSH and
	   where the SSH daemon does not use the PATH configured by the user.

       --exit-code
	   Exit with status "2" when no matching refs are found in the remote repository. Usually the command exits with status "0" to indicate it
	   successfully talked with the remote repository, whether it found any matching refs.

       <repository>
	   Location of the repository. The shorthand defined in $GIT_DIR/branches/ can be used. Use "." (dot) to list references in the local
	   repository.

       <refs>...
	   When unspecified, all references, after filtering done with --heads and --tags, are shown. When <refs>... are specified, only
	   references matching the given patterns are displayed.

EXAMPLES

	   $ git ls-remote --tags ./.
	   d6602ec5194c87b0fc87103ca4d67251c76f233a	   refs/tags/v0.99
	   f25a265a342aed6041ab0cc484224d9ca54b6f41	   refs/tags/v0.99.1
	   7ceca275d047c90c0c7d5afb13ab97efdf51bd6e	   refs/tags/v0.99.3
	   c5db5456ae3b0873fc659c19fafdde22313cc441	   refs/tags/v0.99.2
	   0918385dbd9656cab0d1d81ba7453d49bbc16250	   refs/tags/junio-gpg-pub
	   $ git ls-remote http://www.kernel.org/pub/scm/git/git.git master pu rc
	   5fe978a5381f1fbad26a80e682ddd2a401966740	   refs/heads/master
	   c781a84b5204fb294c9ccc79f8b3baceeb32c061	   refs/heads/pu
	   b1d096f2926c4e37c9c0b6a7bf2119bedaa277cb	   refs/heads/rc
	   $ echo http://www.kernel.org/pub/scm/git/git.git >.git/branches/public
	   $ git ls-remote --tags public v*
	   d6602ec5194c87b0fc87103ca4d67251c76f233a	   refs/tags/v0.99
	   f25a265a342aed6041ab0cc484224d9ca54b6f41	   refs/tags/v0.99.1
	   c5db5456ae3b0873fc659c19fafdde22313cc441	   refs/tags/v0.99.2
	   7ceca275d047c90c0c7d5afb13ab97efdf51bd6e	   refs/tags/v0.99.3

GIT

       Part of the git(1) suite

Git 1.7.10.4							    11/24/2012							  GIT-LS-REMOTE(1)