API for changing UIDs of other processes

API for changing UIDs of other processes

[Enrico Weigelt]

Hi folks,


I'd like to build some authentication daemon which alters the
privileges of another process (like factotum does on plan9).
But I couldn't find any interface for that (setuid() and friends
only operate on the current process). So I'm now going to create
my own interface.

As a little learning example I just added a few files to the
per-pid dirs: uid, euid, suid, fsuid. This was trivial :)

Now I'd like to add an write capability to these files: 
simply writing another number changes the (|s|fs)uid.

But this doesnt seem that trivial. Perhaps someone could give
me some advice ?


cu
-- 
---------------------------------------------------------------------
 Enrico Weigelt    ==   metux IT service - http://www.metux.de/
---------------------------------------------------------------------
 Please visit the OpenSource QM Taskforce:
 	http://wiki.metux.de/public/OpenSource_QM_Taskforce
 Patches / Fixes for a lot dozens of packages in dozens of versions:
	http://patches.metux.de/
---------------------------------------------------------------------

Re: API for changing UIDs of other processes

[Jan Engelhardt]

On Friday 2008-05-02 14:16, Enrico Weigelt wrote:
>Hi folks,
>
>
>I'd like to build some authentication daemon which alters the
>privileges of another process (like factotum does on plan9).
>But I couldn't find any interface for that (setuid() and friends
>only operate on the current process). So I'm now going to create
>my own interface.
>
>As a little learning example I just added a few files to the
>per-pid dirs: uid, euid, suid, fsuid. This was trivial :)
>
>Now I'd like to add an write capability to these files: 
>simply writing another number changes the (|s|fs)uid.
>
>But this doesnt seem that trivial. Perhaps someone could give
>me some advice ?

Not really hard, is it? Just look at something like oom_adj

static ssize_t myprocpid_euid_write(struct file *file,
    const char __user *inbuf, size_t size)
{
	struct task_struct *task;
	char buf[sizeof("4294967296")];
	unsigned int amount = min(size, sizeof(buf) - 1);

	if (copy_from_user(buf, inbuf, amount) != 0)
		return -EFAULT;
	buf[amount] = '\0';

	task = get_proc_task(file->f_path.dentry->d_inode);
	if (task == NULL)
		return -ESRCH;

	/* do error checking */
	task->euid = simple_strtoul(buf, NULL, 0);
	put_task_struct(task);
	return size;
}

So far the theory..

Re: API for changing UIDs of other processes

[Enrico Weigelt]

* Jan Engelhardt <jengelh@medozas.de> wrote:

> >Now I'd like to add an write capability to these files: 
> >simply writing another number changes the (|s|fs)uid.
> >
> >But this doesnt seem that trivial. Perhaps someone could give
> >me some advice ?
> 
> Not really hard, is it? Just look at something like oom_adj

Well, it's not that trivial than just an ro string file.
But not that hard as I first suspected :)

I've introduced a few new helpers for rw integers, which works
quite similar to the ro string stuff, but with anouther handler type.

I'll post a patch in the new testers list.

The next step is actually changing the uid. Can I just write 
new values to the uid field(s) in the task struct or is there
something tricky about that ?


cu
-- 
---------------------------------------------------------------------
 Enrico Weigelt    ==   metux IT service - http://www.metux.de/
---------------------------------------------------------------------
 Please visit the OpenSource QM Taskforce:
 	http://wiki.metux.de/public/OpenSource_QM_Taskforce
 Patches / Fixes for a lot dozens of packages in dozens of versions:
	http://patches.metux.de/
---------------------------------------------------------------------