[Solved] effective user id upon exec


 
Thread Tools Search this Thread
Top Forums UNIX for Dummies Questions & Answers [Solved] effective user id upon exec
# 1  
Old 11-09-2011
[Solved] effective user id upon exec

Hello all.
Despite the exec man page, the exec system call seems to turn my effective-user-id into my real-user-id.

I coded and compiled 2 very simple c programs as user 1 (uid=501)
The first one (A) prints real and effective user IDs and then execs the second one (B), which in turn prints its IDs.
I then added the set-user-id bit to A's permissions:
chmod ug+s A
Didn't change B at all.
Finally user 2 (uid=502) launched A.

Here is the output:
[user2@grmdcis06 tmp]$ ./A
UID GID
Real 502 Real 502
Effective 501 Effective 500
Executing command...
UID GID
Real 502 Real 502
Effective 502 Effective 502

As it turns out, the effective user id gets changed by the exec.

A:
Code:
#include <stdio.h>
#include <stdlib.h>
int main ()
{
  printf(
        "         UID           GID  \n"
        "Real      %d  Real      %d  \n"
        "Effective %d  Effective %d  \n",
        getuid (),     getgid (),
        geteuid(),     getegid()
        );
  printf ("Executing command...\n");
  execl ("./B", NULL);
}


B:
Code:
#include <stdio.h>
#include <stdlib.h>
int main ()
{
  printf(
        "         UID           GID  \n"
        "Real      %d  Real      %d  \n"
        "Effective %d  Effective %d  \n",
        getuid (),     getgid (),
        geteuid(),     getegid()
        );
  return 0;
}


Any tip for avoiding this?

Thank you in advance

cesare
# 2  
Old 11-09-2011
What system is this?
This User Gave Thanks to Corona688 For This Post:
# 3  
Old 11-09-2011
This is expected behavior -- From the the POSIX standard:

Quote:
If the ST_NOSUID bit is set for the file system containing the new process image file, then the effective user ID, effective group ID, saved set-user-ID, and saved set-group-ID are unchanged in the new process image. Otherwise, if the set-user-ID mode bit of the new process image file is set, the effective user ID of the new process image shall be set to the user ID of the new process image file. Similarly, if the set-group-ID mode bit of the new process image file is set, the effective group ID of the new process image shall be set to the group ID of the new process image file. The real user ID, real group ID, and supplementary group IDs of the new process image shall remain the same as those of the calling process image. The effective user ID and effective group ID of the new process image shall be saved (as the saved set-user-ID and the saved set-group-ID) for use by setuid().
I think this applies to your problem, is your system POSIX-compliant?
This User Gave Thanks to jim mcnamara For This Post:
# 4  
Old 11-09-2011
Hi guys.
Thanks to both of you.

@corona688 The system is a CentOS.
[cesare@grmdcis06 tmp]$ uname -a
Linux grmdcis06.netikos.com 2.6.9-78.ELsmp #1 SMP Fri Jul 25 00:04:28 EDT 2008 i686 i686 i386 GNU/Linux

@jim
I had read that part; sorry, but I still can't understand.
Why do you say it is expected behavior. The exec'd file (the B) has no set-user-id-flag set. The effective user id shouldn't be affected at all. Am I missing something? :?

Thanks

\c
# 5  
Old 11-09-2011
It's not a file option. It's a file system option, which applies to any file in the entire partition.
# 6  
Old 11-09-2011
No. I'm saying that is expected behavior for POSIX compliant systems. CentOS does not claim to be fully POSIX-compliant.

It is a mix of of open-source components mostly from linux distributions. The code has been modified and then incorporated into the CentOS distibution.

The behavior you have is not compliant as far as I can see.
# 7  
Old 11-10-2011
Quote:
Originally Posted by Corona688
It's not a file option. It's a file system option, which applies to any file in the entire partition.
Hold on; I was talking about the set-user-id permission flag.
You mean the ST_NOSUID, which you are right is a system option.

Anyway, the strange bevaior here is, in my opinion another one:
I'm claiming that the executable B file is a normal exe file with no set-uid bit.
When the process A (which do has the suid bit set) is execd by the shell, it comes up with a real user id of 502 (user2=502 is the user issuing the command), and an effective-user-id of 501 (user1=501 is the A's owner). That's expected behavior, since A is a set-uid executable and therefore the effective user id has changed, as expected.
But -here comes the weird stuff- when A execs B, the effective-user-id is turned into the real user id, even if B is a normal executable file without suid. It still sounds odd to me.

Maybe there's something I miss. Apologize if everything is clear for you.

\c

---------- Post updated 10-11-11 at 12:50 AM ---------- Previous update was 09-11-11 at 04:09 PM ----------

Good morning Smilie
In Italy we say "la notte porta consiglio".

I figured out the problem is the shell.
The exec family has many different functions. I chose the bad one.
If the shell is used (and it is with execl), you lose privileges, since sh doesn't preserve it by design, maybe for avoiding malicious trojan horses.
Anyway, using execv solves the problem: the effective-user-id is preserved across process invocations.

Thanks to you all anyway.

May this be usefull in the future for you as well.
I'm pretty sure I'll forget it tomorrow...

Bye

\c
This User Gave Thanks to oviv For This Post:
 
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Programming

Real, effective and saved user id in C program

I figured it out by now. (0 Replies)
Discussion started by: Ralph
0 Replies

2. UNIX for Advanced & Expert Users

Regarding real example of user of semicolon(;) and + in find/exec command.

Hello All, Was recently working on an requirement where we have to search files more than a specific number, following is the example on same. Let's say file names are test_40000.txt,test_40001.txt and so on till test_99999.txt. Now requirement was to search from find command only those... (1 Reply)
Discussion started by: RavinderSingh13
1 Replies

3. Shell Programming and Scripting

[solved] awk: placement of user-defined functions

Hi folks, is there any recommendation, especially from a point of performance, about where to place a user-defined function in awk, like in BEGIN{} or if it is only need once at the end in END{}? Or doesn't it matter at all since, awk is so clever and only interprets it once, wherever it is... (3 Replies)
Discussion started by: zaxxon
3 Replies

4. UNIX for Dummies Questions & Answers

[Solved] Loading user profile

I need some help on solaris, setting java path: $ PATH=/var/tmp/jdk1.5.0_22/jre/bin $ export PATH $ java -version I got the correct version for the application to run, which is: java version "1.5.0_22" Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_22-b03) Java... (7 Replies)
Discussion started by: fretagi
7 Replies

5. UNIX for Dummies Questions & Answers

[Solved] weird in find -exec command

i feel weird with this 2 command find /tmp/*test* -user `whoami` -mtime +1 -type f -exec rm -f {}\; find /tmp/*test* -user `whoami` -mtime +1 -type f -exec ls -lrt {}\; the first one return correct which only delete those filename that consist *test* where second command it listed all the... (12 Replies)
Discussion started by: lsy
12 Replies

6. HP-UX

[Solved] mailx : unknown user issue

Hi all, I know this issues has been discussed multiple times, i have gone through many such discussion but unfortunately i am still not able to solve the issue being faced. I have configured the sendmail.cf with the smtp host name (Editing the entry starting with DS...) Post that restarted... (7 Replies)
Discussion started by: chpsam
7 Replies

7. Shell Programming and Scripting

Script Variables Inquiry, Values Okay in Standalone Exec, No-Show in Cron Exec

I have the following bash script lines in a file named test.sh. #!/bin/bash # # Write Date to cron.log # echo "Begin SSI Load $(date +%d%b%y_%T)" # # Get the latest rates file for processing. # d=$(ls -tr /rms/data/ssi | grep -v "processed" | tail -n 1) filename=$d export filename... (3 Replies)
Discussion started by: ginowms
3 Replies

8. Shell Programming and Scripting

[Solved] Use of until loop for user confirmation

Below is my script that is using to rename the name of file .Here I am using two methods to pass the both arguments wih script name or run the script and give the input one by one.But my issue is I want to rename the name of the file if user select Y(y) then it should rename the file else select... (4 Replies)
Discussion started by: anuragpgtgerman
4 Replies

9. Shell Programming and Scripting

exec script as user on boot not root

Is there a way to change a process owned by root to be owned by another user. I am interested in finding out if there is a way to put a script in /etc/rc2.d that will start up automatically on reboot that will not be owned by root This is for security reasons.. The Service that runs on my server... (7 Replies)
Discussion started by: chipmunken
7 Replies

10. Cybersecurity

Changing effective user

I would like to give execution rights for a script to one user. (that's the easy part...) When that user is running the script, I would like the effective user ID to be that of the file-owner. Is this possible? (6 Replies)
Discussion started by: hilmel
6 Replies
Login or Register to Ask a Question