0

This is a repost after being referred to "Calling a script from a setuid root C program - script does not run as root" for a solution

My problem is different in that I do not want to run the C program (and c-shell script called inside) as root. Rather, I want to run as the owner of the c program file.

Also, I tried with "setuid(0)" as this was the solution in the referenced post. This is reflected in the edited code below. Same results.

Also, I opened permissions up all the way this time with "chmod 7775" (just in case it was a permissions problem)

Here's the original note with edits to reflect the change to "setuid(0)"

I'm having a problem implementing an simple example that would demonstrate how setuid can be made to run a binary with the uid of the file owner of the binary. What I would eventually like to do is run a c-shell script using this technique. I read that this will not work for shell scripts but also heard of a work-around using a C program to run a system() call that'll run the c-shell script ( e.g. system("source my.csh") ). I wrote a C program that attempts this, plus simply reports the current uid. This is what I tried...

From my current shell, I did a "su katman" to become the user of the binary I want to run as user katman.

I created a C program try.c. ...

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>

int main()
{
  setuid(0);
  printf("In try.c ... sourcing katwhoami.csh...\n");
  system( "source /home/me/su_experiments/katwhoami.csh");
  printf("In try.c ... using straight system call...\n");
  system("whoami");

  return 0;
}

I "setuid(0)" as recommended by a reference to a different note. But earlier, I tried setting it to the uid of the C program's owner as obtained with "id -u".

The katwhoami.csh shell script is simply...

date
echo "In katwhoami.csh, I am "`whoami`
echo "In katwhoami.csh, I am "$USER
exit

Then I compiled the C program and set the bit...

% gcc -o try try.c
% chmod 7775 try
% ls -l try
-rwsrwsr-x 1 katman design 6784 Mar  1 11:59 try

And then I test it...

% try
In try.c ... sourcing katwhoami.csh...
Thu Mar  1 12:28:28 EST 2018
In katwhoami.csh, I am ktadmin
In katwhoami.csh, I am ktadmin
In try.c ... using straight system call...
ktadmin

...which is what I expected.

I exit to get back to the shell I started from, hoping that if I run try there, it'll tell me I'm "katman"....

% exit
% whoami
daveg
% try
In try.c ... sourcing katwhoami.csh...
Thu Mar  1 12:30:04 EST 2018
In katwhoami.csh, I am daveg
In katwhoami.csh, I am daveg
In try.c ... using straight system call...
daveg

... which is not what I was hoping for :-(

As you can probably tell, I'm new at using this.
Any help would be appreciated !

Update....

I tried a new sample program, a.c...

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>

int main()
{
  FILE *fh;

  setuid(1234);
  system("whoami"); 

  fh=fopen("test.file","w");
  fprintf(fh,"Here I am\n");
  fclose(fh);

  return 0;
}

I compiled and set the bit

gcc -o a a.c
chmod 4775 a

Then I exited the "su" and ran as a user that is NOT the owner of the binary. Same result as before with regard to reported uid (the current uid), BUT, the owner of the file that the C program created ion this version was the owner of the C program !!! So that worked.

Is there something fishy about the "whoami" command? system() call ?

If I do a "system("source some.csh") does it create a new shell which assumes the original uid (not the owner of the C binary) ? Something like that ?

I really need the new uid to "stick" as far as child processes.

daveg
  • 1,051
  • 11
  • 24
  • Using `source` in `system` is generally useless. Read [ALP](http://www.cse.hcmut.edu.vn/~hungnq/courses/nap/alp.pdf). You forgot to test that `setuid` succeeded – Basile Starynkevitch Mar 01 '18 at 17:49
  • 1
    Possible duplicate of [Calling a script from a setuid root C program - script does not run as root](https://stackoverflow.com/questions/556194/calling-a-script-from-a-setuid-root-c-program-script-does-not-run-as-root) – Joe Mar 01 '18 at 17:49
  • Did you make the compiled C program setuid? – dbush Mar 01 '18 at 19:26
  • I added a line to test the setuid (printf("uid is: %d\n",getuid())). It confirmed that it was set right. Yes, I did a chmod 7775 of the binary generated by the gcc. I added an update to the original post. I changed the "setuid(0)" back to "setuid(1234)" after learning that 0 was the uid of root (and I don't have root). I also tested with a new C program and noticed that a file created by this binary is owned by the owner of the binary. So it works, in part. I fear that the system calls are creating new shells which do not inherit the newly set uid. Can anyone confirm this ? – daveg Mar 01 '18 at 20:12
  • in a first step, I would check return value of `setuid()`.... – ensc Mar 01 '18 at 21:25
  • I did with this line.... printf("uid is: %d\n",getuid()) – daveg Mar 01 '18 at 22:39
  • @daveg that's not checking the return value of `setuid`. The `setuid` call returns an `int` From the man page: **On success, zero is returned. On error, -1 is returned, and `errno` is set appropriately** – Joe Mar 01 '18 at 23:17

0 Answers0