Problem - Kevin Tafuro

Normally, the two processes are closely related. Usually they’re the same program
split during initialization into two separate processes using fork( ). The original process
retains its privileges and enters a loop waiting to service requests from the child
process. The child process starts by permanently dropping the extra privileges inherited
from the parent process and continues normally, sending requests to the parent
when it needs privileged operations to be performed.
By separating the process into privileged and unprivileged pieces, the risk of a privilege
escalation attack is significantly reduced. The risk is further reduced by the parent
process refusing to perform any operations that it knows the child does not need.
For example, if the program never needs to delete any files, the privileged process
should refuse to service any requests to delete files. Because the unprivileged child
process undertakes most of the program’s functionality, it stands the greatest risk of
compromise by an attacker, but because it has no extra privileges of its own, an
attacker does not stand to gain much from the compromise.
A privilege separation library: privman
NAI Labs has released a library that implements privilege separation on Unix with an
easy-to-use API. This library, called privman, can be obtained from http://opensource.
nailabs.com/privman/. As of this writing, the library is still in an alpha state and the
API is subject to change, but it is quite usable, and it provides a good generic framework
from which to work.
A program using privman should include the privman.h header file and link to the
privman library. As part of the program’s initialization, call the privman API function
priv_init( ), which requires a single argument specifying the name of the program.
The program’s name is used for log entries to syslog (see Recipe 13.11 for a
discussion of logging), as well as for the configuration file to use. The priv_init( )
function should be called by the program with root privileges enabled, and it will
take care of splitting the program into two processes and adjusting privileges for each
half appropriately.
The privman library uses configuration files to determine what operations the privileged
half of a program may perform on behalf of the unprivileged half of the same
program. In addition, the configuration file determines what user the unprivileged
half of the program runs as, and what directory is used in the call to chroot( ) in the
unprivileged process (see Recipe 2.12). By default, privman runs the unprivileged
process as the user “nobody” and does a chroot( ) to the root directory, but we
strongly recommend that your program use a user specifically set up for it instead of
“nobody”, and that you chroot( ) to a safe directory (see Recipe 2.4).
When the priv_init( ) function returns control to your program, your code will be
running in the unprivileged child process. The parent process retains its privileges, and
control is never returned to you. Instead, the parent process remains in a loop that
responds to requests from the unprivileged process to perform privileged operations.
22 | Chapter 1: Safe Initialization
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.