Problem - Kevin Tafuro

strings suitable for use here. Each of these macros begins with SE_, which is followed
by the name of the privilege. For example, the SeBackupPrivilege privilege
has a corresponding macro named SE_BACKUP_NAME.
lpLuid
Pointer to a caller-allocated LUID object that will receive the LUID information if
the lookup is successful. LUID objects are a fixed size, so they may be allocated
either dynamically or on the stack.
See Also
Recipe 1.8
1.3 Dropping Privileges in setuid Programs
Problem
Your program runs setuid or setgid (see the “Discussion” section for definitions),
thus providing your program with extra privileges when it is executed. After the
work requiring the extra privileges is done, those privileges need to be dropped so
that an attacker cannot leverage your program during an attack that results in privilege
elevation.
Solution
If your program must run setuid or setgid, make sure to use the privileges properly so
that an attacker cannot exploit other possible vulnerabilities in your program and
gain these additional privileges. You should perform whatever work requires the
additional privileges as early in the program as possible, and you should drop the
extra privileges immediately after that work is done.
While many programmers may be aware of the need to drop privileges, many more
are not. Worse, those who do know to drop privileges rarely know how to do so
properly and securely. Dropping privileges is tricky business because the semantics
of the system calls to manipulate IDs for setuid/setgid vary from one Unix variant to
another—sometimes only slightly, but often just enough to make the code that
works on one system fail on another.
On modern Unix systems, the extra privileges resulting from using the setuid or setgid
bits on an executable can be dropped either temporarily or permanently. It is best
if your program can do what it needs to with elevated privileges, then drop those
privileges permanently, but that’s not always possible. If you must be able to restore
the extra privileges, you will need to be especially careful in your program to do
everything possible to prevent an attacker from being able to take control of those
16 | Chapter 1: Safe Initialization
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.