using mount from SUID scripts?

using mount from SUID scripts?

[Matthew Dharm]

[-- Attachment #1: Type: text/plain, Size: 757 bytes --]

I've got an SUID perl script (yes, it's EUID is really 0) which I'd like to
use mount from to mount a file via loopback...

Unfortunately, it looks like mount refuses to actually mount anything if
the EUID and UID aren't the same....

Does anyone happen to know a way around this?  Yes, I know this isn't the
most secure thing in the world... but I'm basically trying to build a
filesystem image and put stuff on it using dd, mkfs, mount, and cp.  It all
works great when run as root, but it really needs to be useable as a
typical user.

Matt

-- 
Matthew Dharm                              Home: mdharm-usb@one-eyed-alien.net 
Maintainer, Linux USB Mass Storage Driver

It was a new hope.
					-- Dust Puppy
User Friendly, 12/25/1998

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]

Re: using mount from SUID scripts?

[Keith Owens]

On Tue, 7 Aug 2001 16:29:39 -0700, 
Matthew Dharm <mdharm-kernel@one-eyed-alien.net> wrote:
>I've got an SUID perl script (yes, it's EUID is really 0) which I'd like to
>use mount from to mount a file via loopback...
>
>Unfortunately, it looks like mount refuses to actually mount anything if
>the EUID and UID aren't the same....

Are you sure the problem is mount?  Some versions of bash drop euid(0)
when they execute scripts from setuid programs.

Re: using mount from SUID scripts?

[Jesse Pollard]

On Tue, 07 Aug 2001, Keith Owens wrote:
>On Tue, 7 Aug 2001 16:29:39 -0700, 
>Matthew Dharm <mdharm-kernel@one-eyed-alien.net> wrote:
>>I've got an SUID perl script (yes, it's EUID is really 0) which I'd like to
>>use mount from to mount a file via loopback...
>>
>>Unfortunately, it looks like mount refuses to actually mount anything if
>>the EUID and UID aren't the same....
>
>Are you sure the problem is mount?  Some versions of bash drop euid(0)
>when they execute scripts from setuid programs.
>

not mount, and likely not the shell - the thing is that perl doesn't like it
when the  effective uid is not equal to the real uid. Perl is very good at
limiting the damange an unsuspecting script does. This is to prevent passing
a "confused" environment to the shell.

The following can work around this:

	($r,$e) = ( $>, $< );	# save real and effective uid's
	$< = $e;		# force real uid to the effective
	`/bin/mount ....`
	($>, $<) = ($r,$e);	# restore mixed state

Remember, the options to mount should come from a fixed table with user
selected input used to select which table entry to use... or a strictly
fixed mount command.

Otherwise you have an even bigger security hole.

-- 
-------------------------------------------------------------------------
Jesse I Pollard, II
Email: jesse@cats-chateau.net

Any opinions expressed are solely my own.

Re: using mount from SUID scripts?

[Matthew Dharm]

[-- Attachment #1: Type: text/plain, Size: 2320 bytes --]

Actually, a strace of mount shows that mount asks for the UID and the EUID,
and seems to exit of it's own accord when they differ.

Tho, if I can force the UID to the EUID, this may work also.

Unfortunately, the snippit of code here doesn't do the job... after the
first two lines, the UID is unchanged, while the EUID is still 0 (root).  I
used system "/usr/bin/id" to verify this.  /bin/mount is still complaining.

Oh, wait... $> is effective and $< is real.  So that first line should be
($r, $e) = ($<, $>); -- this makes everything happy!

Thanks tons, folks!

Matt Dharm

On Tue, Aug 07, 2001 at 09:29:07PM -0500, Jesse Pollard wrote:
> On Tue, 07 Aug 2001, Keith Owens wrote:
> >On Tue, 7 Aug 2001 16:29:39 -0700, 
> >Matthew Dharm <mdharm-kernel@one-eyed-alien.net> wrote:
> >>I've got an SUID perl script (yes, it's EUID is really 0) which I'd like to
> >>use mount from to mount a file via loopback...
> >>
> >>Unfortunately, it looks like mount refuses to actually mount anything if
> >>the EUID and UID aren't the same....
> >
> >Are you sure the problem is mount?  Some versions of bash drop euid(0)
> >when they execute scripts from setuid programs.
> >
> 
> not mount, and likely not the shell - the thing is that perl doesn't like it
> when the  effective uid is not equal to the real uid. Perl is very good at
> limiting the damange an unsuspecting script does. This is to prevent passing
> a "confused" environment to the shell.
> 
> The following can work around this:
> 
> 	($r,$e) = ( $>, $< );	# save real and effective uid's
> 	$< = $e;		# force real uid to the effective
> 	`/bin/mount ....`
> 	($>, $<) = ($r,$e);	# restore mixed state
> 
> Remember, the options to mount should come from a fixed table with user
> selected input used to select which table entry to use... or a strictly
> fixed mount command.
> 
> Otherwise you have an even bigger security hole.
> 
> -- 
> -------------------------------------------------------------------------
> Jesse I Pollard, II
> Email: jesse@cats-chateau.net
> 
> Any opinions expressed are solely my own.

-- 
Matthew Dharm                              Home: mdharm-usb@one-eyed-alien.net 
Maintainer, Linux USB Mass Storage Driver

You suck Stef.
					-- Greg 
User Friendly, 11/29/97

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]

Re: using mount from SUID scripts?

[Jesse Pollard]

...
> Unfortunately, the snippit of code here doesn't do the job... after the
> first two lines, the UID is unchanged, while the EUID is still 0 (root).  I
> used system "/usr/bin/id" to verify this.  /bin/mount is still complaining.
> 
> Oh, wait... $> is effective and $< is real.  So that first line should be
> ($r, $e) =3D ($<, $>); -- this makes everything happy!

drat... I thought I had that right...

Also the last line should be swapped too:

	($r, $e) = ($<, $>);
	$< =3D $e;
	<<<do stuff>>>
	($<, $>) = ($r,$e);

-------------------------------------------------------------------------
Jesse I Pollard, II
Email: pollard@navo.hpc.mil

Any opinions expressed are solely my own.