Questions tagged [suid]
78 questions
4
votes
1 answer
ptrace suid process (after it drops previlege)
I understand that we cannot do ptrace on suid binaries. However, I'm wondering why we cannot do ptrace after the binary drops its previlege to uid instead of euid.
For example, in the binary the suid binary drops privilege after some steps.
seteuid…
user3150318
- 49
- 4
4
votes
1 answer
gdb exiting instead of spawning a shell
I am trying to exploit a SUID program.
The program is:
#include
#include
#include
#include
#define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000) { setresuid(geteuid(), geteuid(), geteuid());…
Sounak Bhattacharya
- 53
- 1
- 5
4
votes
1 answer
run bash script with suid set on file
I wrote a small bash script to test suid permission
$ cat phone.sh
#!/bin/sh
echo "abc" >> out.txt
$ ls -l out.txt phone.sh
-rw-r--r-- root wzj ... out.txt
-rwsr-xr-x root wzj ... phone.sh
$ ./phone.sh
./phone.sh: 2:…
おおさま
- 257
- 4
- 9
3
votes
1 answer
Is this a safe suid/capability wrapper for (Python) scripts?
(Note: I’ve Linux in mind, but the problem may apply on other platforms.)
Problem: Linux doesn’t do suid on #! scripts nor does it activate “Linux capabilities” on them.
Why dow we have this problem? Because during the kernel interpreter setup to…
Robert Siemer
- 32,405
- 11
- 84
- 94
3
votes
2 answers
From PHP/Apache, exec() or system() program as root: "sudo: unable to open audit system: Permission denied"
I have been spending half a day trying to figure this out, and I've done a lot of research. I'm also familiar with many of the existing discussions on this topic, such as this one:
How to run PHP exec() as root?
Unfortunately, none of the…
Timothy Miller
- 1,527
- 4
- 28
- 48
3
votes
3 answers
Why many Linux distros use setuid instead of capabilities?
capabilities(7) are a great way for not giving all root privileges to a process and AFAIK can be used instead of setuid(2). According to this and many others,
"Unfortunately, still many binaries have the setuid bit set, while they should be…
EmbeddedDeveloper
- 75
- 7
3
votes
1 answer
Is set-user-id bit set?
I'm going to write a code which will extensively execute other programs. I don't want it to have root privileges if someone set a set-user-id bit(and root is an owner). So I'm going to drop privileges at startup.
My question is:
How can I…
Shamdor
- 3,019
- 5
- 22
- 25
3
votes
2 answers
Use of setreuid() where _POSIX_SAVED_IDS is not set
I am exploring the suid area, and found myself unable to answer this question. For the sake of the question, lets assume the program binary is suid, owned by user 1001 and ran by user 1000 (both non-root) - therefor RUID=1000, EUID=1001.
When…
The-Q
- 233
- 1
- 7
2
votes
0 answers
suid is not honoured inside docker container
I downloaded sudo in my DockerFile
RUN yum -y update &&
yum -y install which sudo
I have set suid bit on it
RUN chown root:root /usr/bin/sudo
RUN chmod 4755 /usr/bin/sudo
In container I see lot of binaries with suid bit set
root@89f28b09dee0 go]#…
sachin gupta
- 31
- 1
- 3
2
votes
1 answer
Error: The SUID sandbox helper binary was found, but is not configured correctly
I'm sorry to just paste an error code, but I have no clue what else to try. I have looked at all the guides on this site, but nothing quite matches my issue. I am using an ubuntu subsystem on windows 10 for the project "Zettlr". Here is the error…
user6697988
2
votes
1 answer
Can gdb debug suid root programs?
I did a program that call setuid(0) and execve("/bin/bash",NULL,NULL).
Then I did chown root:root a.out && chmod +s a.out
When I execute ./a.out I get a root shell. However when I do gdb a.out it starts the process as normal user, and launch a user…
jyz
- 6,011
- 3
- 29
- 37
2
votes
3 answers
cant run electron on win10 ubuntu subsystem
i have a repo for an electron project ive been able to run in ubuntu subsystem before fine, im on a new pc now and having trouble. I already ran npm i, but when I run electron . i get this…
Martin
- 1,336
- 4
- 32
- 69
2
votes
3 answers
/etc/shadow and suid dilemma
I stumbled on a problem about accessing system files with suid executables.
I wrote this short POC:
#include
#include
int main()
{
if (access("/etc/shadow", W_OK) == 0)
printf("shadow writable!\n");
else
…
Davide Berra
- 6,387
- 2
- 29
- 50
2
votes
2 answers
Why is it common for binary (ELF) SUID executables to also allow READ access?
As part of the recent "rowhammer" exploit proof-of-concept, a read-suid-exec tool "ping" was used to create a more finely tuned proof of concept.
And so my question - why do various distributions prepare suid (especially root) executables as…
Richard Conto
- 78
- 5
2
votes
2 answers
SUID permission (and its effect on ownership)
I'm currently studying for the LPIC-1 Linux Certification. For this, I'm using the 'All-in-One' Exam Guide, released by McGraw Hil & edited by Robb Tracy. (First edition, with no errata available on the McGraw Hill website).
When I research SUID…
Chris
- 191
- 16