Re: Sendmail 8.10.2, Linux 2.4.0 - capabilities

[solar () FALSE COM (Solar Designer)]

Hello,

[ Disclaimer: I haven't tried any of the modules posted. ]

> > if(current->uid && !cap_raised(dataptr->inheritable, CAP_SETUID)) {

> I've tested this code against smlnx (posted a few days ago by Wojciech
> Purczynski): I got a suid shell and no logging was done.

I am assuming you ran the exploit as a non-root user.

> Adding a check before the 'if' shows that the current uid is 0... has this
> anything to do with the fact that capset is called within a shared library?

No.

It is likely that your kernel was built with SMP support, but you've
compiled the module without -D__SMP__.  current is defined differently
for UP and SMP builds, so current->uid might have been referring to
something other than the UID, and it could have happened to be zero.

Just something to be aware of when doing hacks like this.

Signed,
Solar Designer