5

I am trying to change my uid to 0 as non-root with the CAP_SETUID capability. I have the following program:

#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/capability.h>
#include <sys/prctl.h>

int main(int argc, char *argv[])
{
    printf("cap setuid in bset: %d\n", prctl(PR_CAPBSET_READ, CAP_SETUID, 0, 0, 0));
    printf("%s\n", cap_to_text(cap_get_file(argv[0]), NULL));
    printf("%s\n", cap_to_text(cap_get_proc(), NULL));
    printf("uid: %d\n", (int) getuid());
    setresuid(0, 0, 0);
    printf("uid: %d\n", (int) getuid());
    return 0;
}

I assign the setuid capability as follows:

sudo /sbin/setcap cap_setuid=ep ./capsetuid

And I get the following output

cap setuid in bset: 1
= cap_setuid+ep
=
uid: 1000
uid: 1000

I would expect the second printf() to also show the CAP_SETUID capability. Somehow my process does not get the setuid file capability. What am I doing wrong here?

4
  • This might help: blog.famzah.net/tag/cap_setuid Sep 30, 2010 at 7:22
  • This also seems to have relevant information - especially near the end: linux.die.net/man/7/capabilities Sep 30, 2010 at 7:26
  • It looks like the process must have the CAP_SETUID privilege (as well as, or instead of, the file). Sep 30, 2010 at 7:27
  • @Jonathan: I just updated the question, you may have been looking at the old question. I found the problem to be that the process does not get the file capabilities, see updated question.
    – Fabian
    Sep 30, 2010 at 7:40

2 Answers 2

3

Just found out that file capabilities need to be enabled on the kernel commandline with file_caps=1.

2

setuid() sets the effective user-id of the process, but getuid() gets the real user-id.

Change the getuid() to geteuid() and it should work.

5
  • If setuid() sets the effective UID, what does the seteuid() function do? Part of the answer is "the same"; the difference is that setuid() does set the real and effective and saved UID values to the given UID if the process has 'appropriate privileges'. Then the subsidiary question is "does possessing the CAP_SETUID privilege confer the appropriate privileges"? Sep 30, 2010 at 7:16
  • euid doesn change neither. The man page says: "If the effective UID of the caller is root, the real UID and saved set-user-ID are also set." I am not root, though, I am priviliged. So I am not sure what happens in my case. I found the problem is in my process not getting the cap_setuid capability. I've updated the question
    – Fabian
    Sep 30, 2010 at 7:17
  • 2
    @Fabian: Does your kernel have file capabilities enabled (CONFIG_SECURITY_FILE_CAPABILITIES=y)? What does ` prctl(PR_CAPBSET_READ, CAP_SETUID, 0, 0, 0)` return?
    – caf
    Sep 30, 2010 at 7:36
  • My kernel does have file capabilities. prctl() returns 1. So from I understand from the manpage, this means that my process does not get cap_setuid because it is blocked by the bounding capability set. Right? How do I change the bounding cap set?
    – Fabian
    Sep 30, 2010 at 7:55
  • 1
    the problem was that file capabilities must be enabled on the kernel command line.
    – Fabian
    Sep 30, 2010 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.