public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* setuid/pthread interaction broken? 'clone_with_uid()?'
@ 2002-02-14 15:51 bert hubert
  2002-02-14 16:00 ` Dave McCracken
  0 siblings, 1 reply; 6+ messages in thread
From: bert hubert @ 2002-02-14 15:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: drepper, torvalds, dmccr

[-- Attachment #1: Type: text/plain, Size: 1088 bytes --]

When a process first issues setuid() and then goes on to create threads,
those threads run under the setuid() uid - all is well. 

However,  once the first thread is created, only the thread calling setuid()
gets setuid in fact. All new threads continue to be created as root.

This behaviour exists under 2.2.18 with glibc 2.1.3 and under 2.4.17 with
glibc 2.2.5, and is shown using the brief program attached.

Is this by design? It appears that all threads created get the uid of the
thread manager process.

>From our standpoint as an application developer, this is nasty. It means
that we have to do everything that needs root before creating the first
thread. This behaviour is also highly non obvious. 

A fix would appear to need a 'clone with uid' syscall, other solutions will
probably cause race condition. 

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
Netherlabs BV / Rent-a-Nerd.nl           - Nerd Available -
Linux Advanced Routing & Traffic Control: http://ds9a.nl/lartc

[-- Attachment #2: testcase.c --]
[-- Type: text/x-csrc, Size: 805 bytes --]

#include <stdio.h>
#include <pthread.h>
#include <errno.h>

void die(const char *what)
{
	fprintf(stderr,"Exiting because of a fatal error %s: %s\n",
		what, strerror(errno));
	exit(1);
}


void *child(void *p)
{
	printf("This is child %d, pid: %d, uid: %d\n", 
	       (int) p, getpid(), getuid());
	return 0;
}


int main(int argc, char **argv)
{
	pthread_t tid1,tid2,tid3;
	void* ret;

	pthread_create(&tid1, 0, child, (void *)1); /* stevens did this too */

	printf("Current pid: %d, current uid: %d\n", getpid(), getuid());
	if(setuid(2000)<0)
		die("setting uid");
	printf("uid now: %d\n",getuid());



	pthread_create(&tid2, 0, child, (void *)2);
	pthread_create(&tid3, 0, child, (void *)3);
	pthread_join(tid1, &ret);
	pthread_join(tid2, &ret);
	pthread_join(tid3, &ret);
	printf("Exiting.\n");
}

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2002-02-14 17:14 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2002-02-14 15:51 setuid/pthread interaction broken? 'clone_with_uid()?' bert hubert
2002-02-14 16:00 ` Dave McCracken
2002-02-14 16:07   ` bert hubert
2002-02-14 16:19     ` Dave McCracken
2002-02-14 17:05       ` bert hubert
2002-02-14 17:14         ` Dave McCracken

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox