Re: [RFC PATCH] newrole suid breakdown

[Michael C Thompson <thompsmc@us.ibm.com>]

Stephen Smalley wrote:
> On the question of checking whether an app is suid, I don't see any way
> to do that in Linux unambiguously, since there is always the case where
> the caller was already in the same uid as the file.

Apparently, there is a way to check. Klaus showed me this yesterday, but 
he pointed out that it might not be accurate due to SELinux transitions. 
I have tried this, it doesn't seem like the context of the executable 
(for transitions) affects this value.

#include <stdio.h>

extern int __libc_enable_secure;

int main() {
	printf("%d\n", __libc_enable_secure);
}

If someone can also confirm this behavior, this could be the solution 
we're looking for. Not sure how acceptable it is though, as it is kinda 
hackish.

Mike


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.