Re: unable to attach to setuid program that as reverted it privilege

[Mark Kettenis <mark.kettenis@xs4all.nl>]

> Date: Tue, 22 Jan 2008 13:59:48 -0600
> From: "Michael Potter" <pottmi@gmail.com>
> 
> Gdb Crew,
> 
> I get this error when attaching to a setuid program that has
> _given_up_ its root privilege setuid(getuid()):
> 
> ---------------------
> x~> gdb -p 19484
> GNU gdb 6.5
> Copyright (C) 2006 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License, and
> you are
> welcome to change it and/or distribute copies of it under certain
> conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for
> details.
> This GDB was configured as "i586-suse-linux".
> Attaching to process 19484
> ptrace: Operation not permitted.            <<<<<=================

This is the only acceptable behaviour.  The program might have dropped
root priviliges but it might still hold resources acquired when it
still had those priviliges and you might be able to exploit those.

You should be able to attach to the process as root.  If not, complain
to the Linux kernel people.