It is possible that iptables is refusing to run because the user executing the process doesn't match the owner of the binary. A process can check both the user's real ID, and the effective user ID (set as a result of the state of the SUID bit on the binary). Some programmes exit if both user IDs don't match.
I cannot say for sure about iptables, but if you can successfully set the bit, then that'd be my guess.
ex:
* user with id =500
* /sbin/iptables with owner = root
* chmod /sbin/iptables with permission: chmod u+s
* when user with id =500 run /sbin/iptables, program iptable will do user's ID= ruid = euid = root >> perform program (iptables -L) will success.
As your means is: user's ID= euid=root but differ ruid(root) of program iptables so normal user cannot perform command (iptables -L).
Sorry for my English. Hope you understand my english.
The euid in this case would be root (0) and the uid would be the users real id (500). Some programmes check this and if they are not the equal they stop.
I just found a system with iptables installed and tried it. Without the suid bit on, it does fail with an error, but it was successful when I flipped suid on, so I don't think it is doing what I suggested.
Something that I noticed when I set the permissions is that iptables is actually a sim link that points to iptables-multi. Is this the case in your environment? If so, did you try setting the suid bit on iptables-multi as it doesn't make sense to set it on the simlink (chmod shouldn't allow it anyway).
Just learning about the privilege escalation method provided by setuid. Correct me if I am wrong but what it does is change the uid of the current process to whatever uid I set. Right ?
So what stops me from writing my own C program and calling setuid(0) within it and gaining root privileges ?
... (2 Replies)
Hi,
Here is the issue. From the program snippet I have Base: 0x1800000000, Size: 0x3FFE7FFFFFFFF which are of 40 and 56 bits. SO I used use bignum to do the math but summing them up I always failed having correct result.
perl interpreter info,
perl, v5.8.8 built for... (0 Replies)
Hi,
OS : Linux
I have an executable (P1) owned by user say "abcd" and the setuid bit is set. And there is another executable (P2) which brings up the process (P1).
When the setuid bit is set, the process P1 is failing, if the setuid bit is not set there is no issue.
I was wondering if... (6 Replies)
hi i have written small script which will login 2 two different users with su but if we run from normal user it prompts for password so
i chnaged the owner of script to root and added setuid bit
with
chmod u+s <script_name>
but when i run the script i get following message
Warning:... (3 Replies)
hi all,
i have a critical and specific problem with respect to set uid bit on user and the dll's
for a binary, (under the userid A)
it needs libraries from /usr/lib and informix libraries from $INFORMIXDIR/lib/esql
but this binary should be kicked off from id B,
hence s-bit on user is... (5 Replies)
I have a binary. It is having the following permissions
rws rws rwx mqm:mqm runmqtrm
The same program on another machine is
rws rws rwx root: mqm runmqtrm
This program is a setuid program.
This is what my understanding is. Whatever user the program is started under, it will finally be... (0 Replies)