...
This noncompliant code example drops privileges to those of the real user and similarly drops the group privileges. However, the order is incorrect because the setgid() function must be run with superuser privileges, but the call to setuid() leaves the effective user ID as nonzero. As a result, if a vulnerability is discovered in the program that allows for the execution of arbitrary code, an attacker can regain the original group privileges.
| Code Block | ||||
|---|---|---|---|---|
| ||||
/* Drop superuser privileges in incorrect order */
if (setuid(getuid()) == -1) {
/* handle error condition */
}
if (setgid(getgid()) == -1) {
/* handle error condition */
}
/* It is still possible to regain group privileges due to
* incorrect relinquishment order */
|
...
This compliant solution relinquished group privileges before taking away the user-level privileges so that both operations execute as intended.
| Code Block | ||||
|---|---|---|---|---|
| ||||
/* Drop superuser privileges in correct order */
if (setgid(getgid()) == -1) {
/* handle error condition */
}
if (setuid(getuid()) == -1) {
/* handle error condition */
}
/*
* Not possible to regain group privileges due to correct relinquishment order
*/
|
...
Under normal circumstances setuid() and related calls do not alter the supplementary group IDs. However, a setuid-root program can alter its supplementary group IDs and then relinquish root privileges, in which case it maintains the supplementary group IDs but lacks the privilege necessary to relinquish them. Consequently, it is recommended that a program relinquish supplementary group IDs immediately before relinquishing root privileges. The following code defines a set_sups() function that will set the supplementary group IDs to a specific array on systems that support the setgroups() function.
| Code Block | ||||
|---|---|---|---|---|
| ||||
/* Returns nonzero if the two group lists are equivalent (taking into
account that the lists may differ wrt the egid */
int eql_sups(const int cursups_size, const gid_t* const cursups_list,
const int targetsups_size, const gid_t* const targetsups_list) {
int i;
int j;
const int n = targetsups_size;
const int diff = cursups_size - targetsups_size;
const gid_t egid = getegid();
if (diff > 1 || diff < 0 ) {
return 0;
}
for (i=0, j=0; i < n; i++, j++) {
if (cursups_list[j] != targetsups_list[i]) {
if (cursups_list[j] == egid) {
i--; /* skipping j */
} else {
return 0;
}
}
}
/* If reached here, we're sure i==targetsups_size. Now, either
j==cursups_size (skipped the egid or it wasn't there), or we didn't
get to the egid yet because it's the last entry in cursups */
return j == cursups_size ||
(j+1 == cursups_size && cursups_list[j] == egid);
}
/* Sets the suplimentary group list, returns 0 if successful */
int set_sups(const int target_sups_size,const gid_t* const target_sups_list) {
#ifdef __FreeBSD__
const int targetsups_size = target_sups_size + 1;
gid_t* const targetsups_list = (gid_t* const) malloc(sizeof(gid_t) * targetsups_size);
if (targetsups_list == NULL) {
/* handle error */
}
memcpy(targetsups_list+1, target_sups_list, target_sups_size * sizeof(gid_t) );
targetsups_list[0] = getegid();
#else
const int targetsups_size = target_sups_size;
const gid_t* const targetsups_list = target_sups_list;
#endif
if (geteuid() == 0) { /* allowed to setgroups, let's not take any chances */
if (-1 == setgroups(targetsups_size, targetsups_list)) {
/* handle error */
}
} else {
int cursups_size = getgroups( 0, NULL);
gid_t* cursups_list = (gid_t*) malloc( sizeof(gid_t) * cursups_size);
if (cursups_list == NULL) {
/* handle error */
}
if (-1 == getgroups( cursups_size, cursups_list)) {
/* handle error */
}
if (!eql_sups(cursups_size, cursups_list, targetsups_size, targetsups_list)) {
if (-1 == setgroups(targetsups_size, targetsups_list)) { /* will probably fail... :( */
/* handle error */
}
}
free( cursups_list);
}
#ifdef __FreeBSD__
free( targetsups_list);
#endif
return 0;
}
|
...