Problem - Kevin Tafuro

} else {
if (newgid != oldgid && getegid( ) != newgid) abort( );
if (newuid != olduid && geteuid( ) != newuid) abort( );
}
}
void spc_restore_privileges(void) {
if (geteuid( ) != orig_uid)
if (seteuid(orig_uid) = = -1 || geteuid( ) != orig_uid) abort( );
if (getegid( ) != orig_gid)
if (setegid(orig_gid) = = -1 || getegid( ) != orig_gid) abort( );
if (!orig_uid)
setgroups(orig_ngroups, orig_groups);
}
See Also
• “Setuid Demystified” by Hao Chen, David Wagner, and Drew Dean: http://www.
cs.berkeley.edu/~daw/papers/setuid-usenix02.pdf
• Recipe 2.1
1.4 Limiting Risk with Privilege Separation
Problem
Your process runs with extra privileges granted by the setuid or setgid bits on the
executable. Because it requires those privileges at various times throughout its lifetime,
it can’t permanently drop the extra privileges. You would like to limit the risk
of those extra privileges being compromised in the event of an attack.
Solution
When your program first initializes, create a Unix domain socket pair using
socketpair( ), which will create two endpoints of a connected unnamed socket. Fork
the process using fork( ), drop the extra privileges in the child process, and keep
them in the parent process. Establish communication between the parent and child
processes. Whenever the child process needs to perform an operation that requires
the extra privileges held by the parent process, defer the operation to the parent.
The result is that the child performs the bulk of the program’s work. The parent
retains the extra privileges and does nothing except communicate with the child and
perform privileged operations on its behalf.
If the privileged process opens files on behalf of the unprivileged process, you will
need to use a Unix domain socket, as opposed to an anonymous pipe or some other
other interprocess communication mechanism. The reason is that only Unix domain
20 | Chapter 1: Safe Initialization
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.