* getuid() vs. geteuid() in auditctl
@ 2012-03-16 21:50 Peter Moody
2012-03-20 18:07 ` Steve Grubb
0 siblings, 1 reply; 5+ messages in thread
From: Peter Moody @ 2012-03-16 21:50 UTC (permalink / raw)
To: linux-audit
line 1162 in auditctl.c has this:
#ifndef DEBUG
/* Make sure we are root */
if (getuid() != 0) {
fprintf(stderr, "You must be root to run this program.\n");
return 4;
}
#endif
Is there any particular reason to use getuid() there as opposed to
geteuid()? In my particular case, we have a setuid helper that allows
a normal user to run 'auditctl -l' (with a clean environment), and
this prevents the setuid helper from working.
Cheers,
peter
--
Peter Moody Google 1.650.253.7306
Security Engineer pgp:0xC3410038
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: getuid() vs. geteuid() in auditctl
2012-03-16 21:50 getuid() vs. geteuid() in auditctl Peter Moody
@ 2012-03-20 18:07 ` Steve Grubb
2012-03-21 16:38 ` Peter Moody
0 siblings, 1 reply; 5+ messages in thread
From: Steve Grubb @ 2012-03-20 18:07 UTC (permalink / raw)
To: linux-audit
On Friday, March 16, 2012 05:50:56 PM Peter Moody wrote:
> line 1162 in auditctl.c has this:
>
> #ifndef DEBUG
> /* Make sure we are root */
> if (getuid() != 0) {
> fprintf(stderr, "You must be root to run this program.\n");
> return 4;
> }
> #endif
>
> Is there any particular reason to use getuid() there as opposed to
> geteuid()?
I suppose it doesn't matter. I never envisioned having a helper application, so
that why its the way it is. Since we are optionally linking in libcap-ng, I
suppose we could even check the capability rather than the euid. Also note that
for certification purposes the file permissions are restricted.
-Steve
> In my particular case, we have a setuid helper that allows
> a normal user to run 'auditctl -l' (with a clean environment), and
> this prevents the setuid helper from working.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: getuid() vs. geteuid() in auditctl
2012-03-20 18:07 ` Steve Grubb
@ 2012-03-21 16:38 ` Peter Moody
2012-03-21 20:12 ` Steve Grubb
0 siblings, 1 reply; 5+ messages in thread
From: Peter Moody @ 2012-03-21 16:38 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
On Tue, Mar 20, 2012 at 11:07 AM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Friday, March 16, 2012 05:50:56 PM Peter Moody wrote:
>> line 1162 in auditctl.c has this:
>>
>> #ifndef DEBUG
>> /* Make sure we are root */
>> if (getuid() != 0) {
>> fprintf(stderr, "You must be root to run this program.\n");
>> return 4;
>> }
>> #endif
>>
>> Is there any particular reason to use getuid() there as opposed to
>> geteuid()?
>
> I suppose it doesn't matter. I never envisioned having a helper application, so
> that why its the way it is. Since we are optionally linking in libcap-ng, I
> suppose we could even check the capability rather than the euid.
Just the CAP_AUDIT_CONTROL capability?
> Also note that
> for certification purposes the file permissions are restricted.
The permissions of the auditctl binary?
> -Steve
>
>> In my particular case, we have a setuid helper that allows
>> a normal user to run 'auditctl -l' (with a clean environment), and
>> this prevents the setuid helper from working.
--
Peter Moody Google 1.650.253.7306
Security Engineer pgp:0xC3410038
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: getuid() vs. geteuid() in auditctl
2012-03-21 16:38 ` Peter Moody
@ 2012-03-21 20:12 ` Steve Grubb
2012-03-21 21:34 ` Peter Moody
0 siblings, 1 reply; 5+ messages in thread
From: Steve Grubb @ 2012-03-21 20:12 UTC (permalink / raw)
To: Peter Moody; +Cc: linux-audit
On Wednesday, March 21, 2012 12:38:06 PM Peter Moody wrote:
> On Tue, Mar 20, 2012 at 11:07 AM, Steve Grubb <sgrubb@redhat.com> wrote:
> > On Friday, March 16, 2012 05:50:56 PM Peter Moody wrote:
> >> line 1162 in auditctl.c has this:
> >>
> >> #ifndef DEBUG
> >> /* Make sure we are root */
> >> if (getuid() != 0) {
> >> fprintf(stderr, "You must be root to run this program.\n");
> >> return 4;
> >> }
> >> #endif
> >>
> >> Is there any particular reason to use getuid() there as opposed to
> >> geteuid()?
> >
> > I suppose it doesn't matter. I never envisioned having a helper
> > application, so that why its the way it is. Since we are optionally
> > linking in libcap-ng, I suppose we could even check the capability
> > rather than the euid.
>
> Just the CAP_AUDIT_CONTROL capability?
On the -m command, it instead needs CAP_AUDIT_WRITE.
> > Also note that
> > for certification purposes the file permissions are restricted.
>
> The permissions of the auditctl binary?
Yes. We ship it 0750.
-Steve
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: getuid() vs. geteuid() in auditctl
2012-03-21 20:12 ` Steve Grubb
@ 2012-03-21 21:34 ` Peter Moody
0 siblings, 0 replies; 5+ messages in thread
From: Peter Moody @ 2012-03-21 21:34 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
On Wed, Mar 21, 2012 at 1:12 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Wednesday, March 21, 2012 12:38:06 PM Peter Moody wrote:
>> On Tue, Mar 20, 2012 at 11:07 AM, Steve Grubb <sgrubb@redhat.com> wrote:
>> > On Friday, March 16, 2012 05:50:56 PM Peter Moody wrote:
>> >> line 1162 in auditctl.c has this:
>> >>
>> >> #ifndef DEBUG
>> >> /* Make sure we are root */
>> >> if (getuid() != 0) {
>> >> fprintf(stderr, "You must be root to run this program.\n");
>> >> return 4;
>> >> }
>> >> #endif
>> >>
>> >> Is there any particular reason to use getuid() there as opposed to
>> >> geteuid()?
>> >
>> > I suppose it doesn't matter. I never envisioned having a helper
>> > application, so that why its the way it is. Since we are optionally
>> > linking in libcap-ng, I suppose we could even check the capability
>> > rather than the euid.
>>
>> Just the CAP_AUDIT_CONTROL capability?
>
> On the -m command, it instead needs CAP_AUDIT_WRITE.
Actually, is there any reason that check can't just be removed to
allow the kernel to reply with an error if an unprivileged/uncapable
user tries executing auditctl? requiring CAP_AUDIT_WRITE seems strange
if the user is just executing auditctl -h or auditctl -v (though those
are the only two commands I can see that a normal user should be able
to execute).
>> > Also note that
>> > for certification purposes the file permissions are restricted.
>>
>> The permissions of the auditctl binary?
>
> Yes. We ship it 0750.
>
> -Steve
--
Peter Moody Google 1.650.253.7306
Security Engineer pgp:0xC3410038
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2012-03-21 21:35 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-03-16 21:50 getuid() vs. geteuid() in auditctl Peter Moody
2012-03-20 18:07 ` Steve Grubb
2012-03-21 16:38 ` Peter Moody
2012-03-21 20:12 ` Steve Grubb
2012-03-21 21:34 ` Peter Moody
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox