文件系统级别的SETUID

Question

Suppose we are looking at the following scenario:

File saymyname.c (includes omitted)

int main(int argc, char** argv){
    system("whoami");   
}

Build and set permission bits:

cake@lie> gcc saymyname.c -o saymyname
cake@lie> sudo chown root:root saymyname
cake@lie> sudo chmod u+s saymyname
cake@lie> ./saymyname
cake

Every resource under the sun tells me that setting the s permission on the user-column should make the program execute with the owner's privileges, not the calling user's. Why does system("whoami"); return cake ?

Modifying the program to set the UID manually like so:

int main(int argc, char** argv){
    setuid(geteuid());
    system("whoami");   
}

Yields the expected result

cake@lie> ./saymyname
root

Some resources claim that the SUID and GUID bits are often ignored. Is this why the observed behavior occurs? If so, is there a way to make it behave as if it was executed by root without setuid(.) ?

Answer 1

Looks like bash, which is executed by system(), drops the privileges. In my tests, replacing the symbolic link /bin/sh pointing to dash (instead of bash) made it work as expected.

Also with bash,

execl("/bin/bash", "bash", "-c", "whoami", NULL);

gives cake, whereas

execl("/usr/bin/whoami", "whoami", NULL);

gives root.

Answer 2

Georg's answer is technically correct ¹ , but it is worth to mention that the system(3) man page explicitly states that the use of system() in setuid programs is not recommended:

Do not use system() from a program with set-user-ID or set-group-ID privileges, because strange values for some environment variables might be used to subvert system integrity. Use the exec(3) family of functions instead, but not execlp(3) or execvp(3) . system() will not, in fact, work properly from programs with set-user-ID or set-group-ID privileges on systems on which /bin/sh is bash version [>=]2, since bash 2 drops privileges on startup. (Debian uses a modified bash which does not do this when invoked as sh.)

This is especially relevant in your example as you are calling whoami without the full path. Imagine the following scenario (as unprivileged user):

> whoami cat << 'EOF'
#!/bin/not-bash :)
echo "I'm root! let's clean up some trash ..."
# rm -rf /
EOF
chmod +x whoami

PATH="${PWD}" ./saymyname

That means, instead of changing the system shell (or using Debian), the code should just use exec() , like this:

int main(int argc, char** argv){
    execl("/usr/bin/whoami", "whoami", NULL);   
}

---

¹ newer versions of dash on Ubuntu will also drop privileges