CODEWITHSUNDEEP
clinux
user3368561
user3368561

Reputation: 819

Changin uid/gid of a running non-provileged process

I need to implement an small capability system for Linux similar to Plan 9 cap device. Host owner (root in Linux) allows user1 to impersonate user2 writing user1@user2@random-string to /dev/caphash. Any user1 process that knows random-string can change its uid to user2 writing user1@user2@random-string to /dev/capuse.

On Linux, any privileged process can impersonate any unprivileged user with setuid(2) system call, but I do not know any mechanism to allow horizontal impersonation. How do Linux do it?

Upvotes: 1

Views: 3037

Answers (2)

Nominal Animal
Nominal Animal

Reputation: 39308

Serge E. Hallyn submitted p9auth to the Linux-kernel mailing list in April 2010, which would have provided pretty much this functionality (albeit in the last submitted form, with a slightly different interface). Unfortunately, it was not included in the Linux kernel.

The underlying security paradigm in Linux is vertical, rather than horizontal.

Privileges are separated into capabilities, and they can be acquired at exec time only. Extra privileges can be dropped at any time. In practice, you use filesystem capabilities and the setcap utility to give an unprivileged binary some specific capabilities whenever it is executed, regardless of the identity of the user executing it. (With Linux kernels 2.6.33 and later, it is no longer possible for any process to modify the capabilities of another running process.)

The key point to notice is that in Linux, only a privileged process (a process with the CAP_SETUID) can change its identity at run time.

In other words, point of exec is used in Linux for elevation of privileges, with the now-privileged binary changing to the specified user (and/or group and perhaps supplementary groups), dropping extra privileges. I am not aware of any mechanism that would allow an unprivileged process to change its credentials without an exec.

For the OP, this means that the Plan 9 interface (/dev/caphash, /dev/capuse) will not work. A comparable Linux interface implemented in userspace will require the exec of a binary as part of the change in credentials, but other than that, I don't know enough of OP's use cases to make any suggestion.

In-kernel, such an interface is obviously possible (as shown by the first link in this answer), just not available in the vanilla kernels.

Upvotes: 2

Luis Colorado
Luis Colorado

Reputation: 12655

In linux (and in unix in general) there's a similar feature that has to do with one of the bit permissions of an executable file. If you have an executable binary file, marked as setuid bit, then when you execute that file, the kernel runs that executable by setting the effective user id of the process to the owner of that file. So the mechanism works if you have execute permissions to execute that file. Let's suppose you want users a, b and c to impersonate user d on execution of some program. You first create a group of users (group setuid_d) in the system and put on it all the users a, b and c. then you create the executable, make it belong to user d, and group setuid_d. Once this has been done, as user d or as root make the file executable only by the group setuid_d and activate the set uid bit in the permissions

$ chgrp setuid_d program
$ chown d program
$ chmod ug+x,o-x,u+s program
$ program  # you'll be effectively user d when executing program

Upvotes: 0

Related Questions