Re: local root on linux 2.2.15

[wp () ELZABSOFT PL (Wojciech Purczynski)]

On Wed, 14 Jun 2000, Jeff Dafoe wrote:

> =====
> Note that checking the return value from setuid() is insufficient;
> the setuid(getuid()) succeeds even when the process does not have
> "appropriate privileges."
> =====

I don't mean the bug in kernel not setting saved UID.

I mean that if process has CAP_SETUID bit cleared and its UID=EUID=0 it
is unable to change its UID and drop privileges. In this scenario process
doesn't need to do setuid(0) after setuid(500) (like sendmail does) to
restore its privilege which normally fails.

As example we may look at procmail. If it is executed from sendmail as
local-mailer with UID=EUID=0 it tried to do setreuid(500, -1) followed by
setuid(500). Both these functions return -EPERM. Procmail ignores the
error value and continues running and forwarding our mail with root
privileges.

+--------------------------------------------------------------------+
| Wojciech Purczynski   wp () elzabsoft pl  http://www.elzabsoft.pl/~wp |
| GSM: +48604432981   Linux Administrator   SMS: wp-sms () elzabsoft pl |
+------ Public GnuPG Key:  http://www.elzabsoft.pl/~wp/gpg.asc ------+