Re: 2.4.16 + strace 4.4 + setuid programs

Re: 2.4.16 + strace 4.4 + setuid programs

[Damian M Gryski]

On Thu, 06 Dec 2001, Keith Warno wrote:
> Hmm.  Is strace supposed to be capable of tracing setuid programs (ie,
> su) when executed by mortal users?  I always thought this was a big
> no-no.

   Seems to me it drops permissions instead of not allowing the trace.

--- 8< --- cut here --- 8< ---
dmg@jolt:[pts/4]:~$ cat euid.c
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

int main() { printf("euid=%d\n", geteuid()); }

dmg@jolt:[pts/4]:~$ ls -l ./euid
-rwsr-sr-x    1 root     root         5039 Dec  6 01:46 ./euid
dmg@jolt:[pts/4]:~$ ./euid
euid=0
dmg@jolt:[pts/4]:~$ strace -o /dev/null ./euid
euid=1000
dmg@jolt:[pts/4]:~$
--- 8< --- cut here --- 8< ---

   Damian

-- 
Damian Gryski ==> dgryski@uwaterloo.ca | Linux, the choice of a GNU generation
512 pt Hacker Test score = 37%         | 500 pt Nerd Test score = 56% 
                   geek / linux zealot / coder / juggler

Re: 2.4.16 + strace 4.4 + setuid programs

[Jason Kohles]

On Thu, Dec 06, 2001 at 01:09:02AM -0500, Keith Warno wrote:
> Hmm.  Is strace supposed to be capable of tracing setuid programs (ie,
> su) when executed by mortal users?  I always thought this was a big
> no-no.
> 
You can trace them, but strace will ignore the setuid bit on the process,
for example if you strace su, you will see a lot of permission denied, as
it won't actually run as root, and won't be able to open things like
/etc/shadow or /proc/self/fd/0.  If you want to strace setuid things and
have the setuid bit honored, you have to run strace as root with the -u
option.

-- 
Jason Kohles                                 jkohles@redhat.com
Senior System Architect                      (703)786-8036 (cellular)
Red Hat Professional Consulting              (703)456-2940 (office)

Re: 2.4.16 + strace 4.4 + setuid programs

[Manfred Spraul]

>  If you want to strace setuid things and
> have the setuid bit honored, you have to run strace as root with the -u
> option.

No, even that's not possible anymore.
setuid is now always ignored if a process is ptraced, even if root
is ptracing - that's the fix for the latest ptrace root exploit
(2.4.1x).

--
	Manfred