Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a wrapper script A which is calling program B. A must be invoked as root so some initial setup can happen. After that, A calls setuid() and setgid() to reduce its own privileges, for safety and security. Then, A invokes B.

The problem is that B exhibits undesirable behavior if and only if A has called setuid()/setgid() before invoking B. This does not happen when I invoke B directly as different users via sudo -u xxx -g xxx. As far as I can tell (correct me if I am wrong), the only way B could know that A has changed the user is via the issetuid() syscall (I've checked the environment variables; they match).

How can I clear this bit, so that B behaves normally? It seems that the use of issetuid() is something about keeping track of whether the process is "tainted", i.e. carries artifacts from a less privileged environment (?). But I've reduced my privileges, not elevated them! And on top of that, I've scrubbed my env vars anyway!

Beyond the very terse man page on issetuid(), I can find almost nothing about this syscall/magical program state. Can anyone lend a better understanding?

share|improve this question

closed as too localized by gertvdijk, Tom Brossman, Alvar, Salem, Ringtail Dec 31 '12 at 2:28

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

In which package does issetuid (header files, documentation, library) live in? I can't find it on my systems, so I assume it is not in libc6-dev or libstd++6-4.6-dev or similar. You can find out the package name automatically with a command like: dpkg -S $(man -w issetuid). – taneli May 15 '12 at 8:28
This could be better suited to StackOverflow or even SuperUser – hexafraction May 18 '12 at 20:10
FWIK setuid bit on script files won't work due to security reasons. Google suid script security may help. – Xiè Jìléi May 22 '12 at 12:12
There is no issetuid syscall. Nor is it a function in the C library. I have no idea where you found a manpage for it; neither man nor Google can. Further, every non-root process has a setuid (or similar) in its history, as init starts as root and spawns them all. – derobert Jun 13 '12 at 18:56
@trbabb None of us seem to be able to find anything about an issetuid function. Is it possible you mean issetugid? Your description, especially the use of the adjective tainted, comports with the description in that function's manpage, and the function it similar to what you seem to have in mind, though it also returns true if the process is setgid (even if not also setuid). – Eliah Kagan Jul 16 '12 at 23:10

Without more information ( such as the name of A and B software ), this is hard to diagnose.

However, I would look at the environment variable, there is surely one that was not cleaned by A and that is cleaned by sudo.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.