Re: Proof of concept patch, add dropping privileges to a non root user

Quoting corentin.labbe (corentin.labbe(a)geomatys.fr): I don't have the original source in front of me, but I think what you'd really want to do here is check that if (geteuid() != 0) { ... } or better yet do a detailed check for the capabilities you need, which I suppose are something like if (!got_caps(CAP_AUDIT_CONTROL | CAP_AUDIT_WRITE)) complain(); if (getuid() != auditd_uid && !got_caps(CAP_SETUID)) complain(); I think it's always worthwhile to follow this by a getresuid(&r, &e, &s); if (r != auditd_uid || e != auditd_uid || s != auditd_uid) bail(); I don't really know that an attacker could set things up so that uid and suid wouldn't get set (i.e. !CAP_SETUID, and uid==auditd_uid, but it's conceivable - i.e. finds a way to drop CAP_SETUID from the bounding set through another vulnerability, then runs a setuid root auditd using 'auditd -u `id -u`'. That's not quite it, as saveduid would have to be 0, and i can't recall offhand whether execve() of a setuid-root binary sets saved_uid to 0 or not. But hopefully this rant is scary enough to convince you that it's worth just making sure :)