Re: unable to attach to setuid program that as reverted it privilege

["Michael Potter" <pottmi@gmail.com>]

On Jan 22, 2008 2:08 PM, Daniel Jacobowitz <drow@false.org> wrote:
> On Tue, Jan 22, 2008 at 01:59:48PM -0600, Michael Potter wrote:
> > I will speculate that the logic behind that is even tho the program
> > does not have root privilege now, it could have something in left over
> > in memory from when it did have root privilege.  I think this is a
>
> Correct.  For instance, it could have an open file descriptor to a
> root-owned file or a privileged network socket.  There's lots of
> things you can inherit.
>
> > good default behavior, but I am hopeful that some clever programmer
> > has found a way to change their program such that gdb can attach to
> > it.
>
> It has nothing to do with the program; this is part of your kernel's
> security model.  Sorry.  I believe it's pretty much universal behavior
> across Unix-like systems.
>
> > Suggestions on alternatives such as a way to switch users without root
> > privileges
> > are welcome.
>
> Allow "sudo -u otheruser ./nonsetuid-copy-of-program" ?
>

My program is a daemon process that runs as root.
When it starts is reduces it's privilege and it returns its privilege
to just long enough to validate the user's password.
It then forks.  The child returns its root priv  to do the one way
switch to the new user.

The reason I think someone may have a solution to this (even if it is
a hack) is that exec will solve the problem.  I do not want to add an
exec to my code because I do not want the overhead of exec.

I am thinking that someone may have written a loadable kernel module
that would be tweak the same bit that exec tweaks that would allow the
connect.  That module would be called by the program.

> --
> Daniel Jacobowitz
> CodeSourcery
>