9

I'm writing a setuid root program. This program needs to open a file for writing and then write some content. It needs euid 0 only for opening the file, then it can drop privileges.

To drop privileges, I could seteuid to the current uid. But I was thinking at switching to nobody:nogroup.

Now, I was wondering: can I assume that nobody is 65534 on every system (and nogroup is 65534 too)? Is it defined by some standard (POSIX, maybe)?

Likk
  • 747
  • 3
  • 7
  • 8
  • It is indeed 65534 on my FreeBSD and Gentoo machines, but on my Arch Linux machine the uid for nobody is 99. So I would say that it's definitely not an assumption you can make in the real world. – Score_Under Jan 16 '16 at 21:42

2 Answers2

8

You can't. nobody has had at least a few different IDs across distros and time:

Historically, the user “nobody” was assigned UID -2 by several operating systems, although other values such as 2^(15)−1 = 32,767 are also in use, such as by OpenBSD. For compatibility between 16-bit and 32-bit UIDs, many Linux distributions now set it to be 2^(16)−2 = 65,534; the Linux kernel defaults to returning this value when a 32-bit UID does not fit into the return value of the 16-bit system calls. An alternative convention assigns the last UID of the range statically allocated for system use (0-99) to nobody: 99.

Maximilian Gerhardt
  • 5,188
  • 3
  • 28
  • 61
ivan_pozdeev
  • 33,874
  • 19
  • 107
  • 152
  • 4
    Can I use getpwnam("nobody")? I mean: is nobody called "nobody" everywhere? – Likk Jan 16 '16 at 21:01
  • @Likk [It's in the LSB](https://unix.stackexchange.com/questions/186568/what-is-nobody-user-and-group) and there's no way to find an account other than by UID or name -- so I would say yes. Note however that the recommended security setup is now to have a separate user account for each daemon rather that using `nobody`. – ivan_pozdeev Jul 20 '20 at 12:49
  • 2
    This is very inconvenient. I think the solution is to keep googling until I find an answer that says 'yes you can'. – Chris Robinson Dec 14 '21 at 14:02
  • @ChrisRobinson "Blessed is he who believes" :-) (S. Griboedov "Woe from Wit") – ivan_pozdeev Dec 16 '21 at 04:56
  • @ivan_pozdeev Well, exactly. "And warmth to him in the world." I'll take that as the necessary benediction of 65534. But thank you for the arcane background. – Chris Robinson Dec 17 '21 at 10:08
0

Maybe you can use the value of /proc/sys/fs/overflowuid.

I'm not sure whether it's the same as UID of "nobody". But it should meet your needs.

snyh
  • 1,225
  • 14
  • 19