[英]setuid(0) with CAP_SETUID
I am trying to change my uid to 0 as non-root with the CAP_SETUID
capability. 我正在尝试使用
CAP_SETUID
功能将我的uid更改为非root用户的0。 I have the following program: 我有以下程序:
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/capability.h>
#include <sys/prctl.h>
int main(int argc, char *argv[])
{
printf("cap setuid in bset: %d\n", prctl(PR_CAPBSET_READ, CAP_SETUID, 0, 0, 0));
printf("%s\n", cap_to_text(cap_get_file(argv[0]), NULL));
printf("%s\n", cap_to_text(cap_get_proc(), NULL));
printf("uid: %d\n", (int) getuid());
setresuid(0, 0, 0);
printf("uid: %d\n", (int) getuid());
return 0;
}
I assign the setuid capability as follows: 我将setuid功能分配如下:
sudo /sbin/setcap cap_setuid=ep ./capsetuid
And I get the following output 我得到以下输出
cap setuid in bset: 1
= cap_setuid+ep
=
uid: 1000
uid: 1000
I would expect the second printf() to also show the CAP_SETUID
capability. 我希望第二个printf()也显示
CAP_SETUID
功能。 Somehow my process does not get the setuid file capability. 我的进程以某种方式没有获得setuid文件的功能。 What am I doing wrong here?
我在这里做错了什么?
刚刚发现,需要在内核命令行上使用file_caps = 1启用文件功能。
setuid()
sets the effective user-id of the process, but getuid()
gets the real user-id. setuid()
设置setuid()
的有效用户ID,但是getuid()
获取实际的用户ID。
Change the getuid()
to geteuid()
and it should work. 将
getuid()
更改为geteuid()
。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.