Login or Register to Ask a Question and Join Our Community


Shell Programming and Scripting

Setuid not working in Linux as script fails to write to file.

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Setuid not working in Linux as script fails to write to file.
# 8  
Old 06-26-2013
Quote:
Originally Posted by rbatte1
Yes it does, but you have to consider the filesystem it is in though.
This is a frequent argument on this forum.

It does not. Period.

I used to think all UNIX shared this behavior, but it's not quite that stark. Some do and some don't.
This User Gave Thanks to Corona688 For This Post:
rbatte1
# 9  
Old 06-26-2013
Thanks for the clarification folks
# 10  
Old 06-27-2013
Thanks for the info, but to try and explore it myself I wrote three scripts that pass control along. I set the middle one as SUID and then a funny thing happened when I edited the file. The server crashed! Smilie

Undeterred, I tried again, same result (good thing it's not production Smilie)

I own the files thus:-
Code:
$ cd ~/unix229213
$ ls -l
total 12
-rwxrwxrwx 1 RBATTE1 techsupp 65 Jun 27 10:13 scr_a.ksh
-rwsrwxrwx 1 RBATTE1 techsupp 66 Jun 27 10:14 scr_b.ksh
-rwxrwxrwx 1 RBATTE1 techsupp 52 Jun 27 10:15 scr_c.ksh

It seems that whenever I write the file, the server crashes. The very simple code runs find, but if I try to sudo chown root scr_b.ksh the server crashes. I can issue the sudo chown if it's not SUID at the time. The filesystem allows SUID, by the way.


What on earth can an un-privileged user be doing wrong Smilie

Naturally, I'm very concerned that a mis-key by someone else may cause them to get an error on the habitual chmod 777 and run chmod 7777 and then editing the file will cause a server crash. The crash happens when actually writing the file. I haven't tried it with a simple redirect yet - I don't want to crash the server yet again!


Output from uname gives me a RHEL version of 2.6.32-279.14.1.el6.x86_64


Robin
Last edited by rbatte1; 06-27-2013 at 06:25 AM.. Reason: Grammar
# 11  
Old 06-27-2013
That bug is new to me, must be related to ext4!
I only know about the "everyone can become root" bug around kernel.perf_event.
# 12  
Old 06-27-2013
Quote:
Originally Posted by rbatte1
Thanks for the info, but to try and explore it myself I wrote three scripts that pass control along. I set the middle one as SUID and then a funny thing happened when I edited the file. The server crashed! Smilie
In what way did it crash? Anything in the logs?
# 13  
Old 06-27-2013
Server went unresponsive. The console was not connected, so nothing there. Looking in /var/log/messages, I have these from this morning:-
Code:
Jun 27 03:23:34 dlvmrhdliv01 rhsmd: This system is registered to RHN Classic
Jun 27 09:15:19 dlvmrhdliv01 sshd[31219]: Accepted password for RBATTE1 from 129.221.180.234 port 1940 ssh2
Jun 27 09:15:19 dlvmrhdliv01 sshd[31219]: pam_unix(sshd:session): session opened for user RBATTE1 by (uid=0)
Jun 27 09:32:38 dlvmrhdliv01 kernel: imklog 5.8.10, log source = /proc/kmsg started.
Jun 27 09:32:38 dlvmrhdliv01 rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1961" x-info="http://www.rsyslog.com"] start
Jun 27 09:32:38 dlvmrhdliv01 kernel: Initializing cgroup subsys cpuset
Jun 27 09:32:38 dlvmrhdliv01 kernel: Initializing cgroup subsys cpu
Jun 27 09:32:38 dlvmrhdliv01 kernel: Linux version 2.6.32-279.14.1.el6.x86_64 (mockbuild@x86-002.build.bos.redhat.com) (gcc version 4.4.6 20120305 (Red Hat 4.4.6-4) (GCC) ) #1 SMP Mon Oct 15 13:44:51 EDT 2012
Jun 27 09:32:38 dlvmrhdliv01 kernel: Command line: ro root=/dev/mapper/vg_rhel63x64-lv_root rd_NO_LUKS  KEYBOARDTYPE=pc KEYTABLE=uk LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto rd_LVM_LV=vg_rhel63x64/lv_swap rd_LVM_LV=vg_rhel63x64/lv_root rd_NO_DM rhgb quiet
Jun 27 09:32:38 dlvmrhdliv01 kernel: KERNEL supported cpus:
Jun 27 09:32:38 dlvmrhdliv01 kernel:  Intel GenuineIntel
Jun 27 09:32:38 dlvmrhdliv01 kernel:  AMD AuthenticAMD
Jun 27 09:32:38 dlvmrhdliv01 kernel:  Centaur CentaurHauls
Jun 27 09:32:38 dlvmrhdliv01 kernel: Disabled fast string operations

..... and then off further into the boot.

I have another test server that should be at the same versions, and it doesn't exhibit this behaviour. Suspicion lies with the replication software that is under test on the one that crashed. Don't panic anyone else, unless you are running (I think it's called) RHA from CA. I will pass this on to the person running that project. Maybe I will just take your word for it and keep quiet.


Robin



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Further testing has shown that this is linked to the replication software under evaluation. I think that this, along with other hangs/crashes will end that evaluation process.


Robin
Last edited by rbatte1; 07-03-2013 at 10:22 AM.. Reason: Cause of hang proved as replication software
# 14  
Old 06-27-2013
it was good the issue was mentioned ... keeping quiet about it does not help anybody ...

if the replication job is the actual culprit and this replication job is deemed fit to be released for production installs into every critical server, not letting anybody else know about the potential for a server crash when doing a simple find from a setuid script could be catastrophic to the environment and goes against what i believe are the duties and responsibilities of a system administrator ... any risks to the supported computing environment should be mitigated as soon as known and not hidden ...

at the least, the company should know about the bug and ensure there are safeguards against it ... it would also help the vendors of the replication software to know this so they can actually fix the issue ...

now the general computing community also benefits ...
Last edited by Just Ice; 06-28-2013 at 09:03 AM.. Reason: to provide clarification
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

What keeps me from abusing setuid(0) and programs with setuid bit set?

Just learning about the privilege escalation method provided by setuid. Correct me if I am wrong but what it does is change the uid of the current process to whatever uid I set. Right ? So what stops me from writing my own C program and calling setuid(0) within it and gaining root privileges ? ... (2 Replies)
Discussion started by: sreyan32
2 Replies

2. UNIX for Beginners Questions & Answers

Linux shell | how to exit a script if any command fails.

Hi, i am new here let me say HI for all. now i have a question please: i am sending one command to my machine to create 3 names. if one of the names exists then the box return error message that already have the name but will continue to create the rests. How i can break the command and... (7 Replies)
Discussion started by: Amiri
7 Replies

3. Red Hat

process fails if setuid bit is set

Hi, OS : Linux I have an executable (P1) owned by user say "abcd" and the setuid bit is set. And there is another executable (P2) which brings up the process (P1). When the setuid bit is set, the process P1 is failing, if the setuid bit is not set there is no issue. I was wondering if... (6 Replies)
Discussion started by: ahamed101
6 Replies

4. Shell Programming and Scripting

Need help! command working ok when executed in command line, but fails when run inside a script!

Hi everyone, when executing this command in unix: echo "WM7 Fatal Alerts:", $(cat query1.txt) > a.csvIt works fine, but running this command in a shell script gives an error saying that there's a syntax error. here is content of my script: tdbsrvr$ vi hc.sh "hc.sh" 22 lines, 509... (4 Replies)
Discussion started by: 4dirk1
4 Replies

5. UNIX for Dummies Questions & Answers

a problem with write a script in Linux version 2.4.27-ubnt0

Hello everyone, I have a radio wireless called UBNT Nanostation5 It has this linux OS:Linux version 2.4.27-ubnt0 When i want to write a script in ssh, i get some errors The script is: ifconfig eth0 down ifconfig eth0 hw ether 00:15:6D:**:**:** ifconfig eth0 up cfg -x echo... (1 Reply)
Discussion started by: cygol
1 Replies

6. UNIX for Advanced & Expert Users

when a process fails to write to /dev/log

Hi , when a process fails to write to /dev/log ? (1 Reply)
Discussion started by: Gopi Krishna P
1 Replies

7. IP Networking

read/write,write/write lock with smbclient fails

Hi, We have smb client running on two of the linux boxes and smb server on another linux system. During a backup operation which uses smb, read of a file was allowed while write to the same file was going on.Also simultaneous writes to the same file were allowed.Following are the settings in the... (1 Reply)
Discussion started by: swatidas11
1 Replies

8. Shell Programming and Scripting

log file when the script fails !

i have a script that will retrive some info from database. The script is working fine but i have to add new feature in it when the script fails or retrive null result it should reflect in the log file. below the script AMR_Inactive.sh while read i do connect1=`sqlplus -silent... (3 Replies)
Discussion started by: ali560045
3 Replies

9. UNIX for Dummies Questions & Answers

Need to write a home-grown backup script for Linux

I am researching ways in which to backup files or whole file systems for backup to another system. We are using Suse Linux 7.0 with no tape backup devices or secondary disks. What utilities would be the best to use for a simple yet flexible script for backup purposes? tar, cpio, compress. (3 Replies)
Discussion started by: darthur
3 Replies
Login or Register to Ask a Question