The problem of Program permission executed by exec

I encapsulated a cat / etc/shadow command in C language, set the suid bit of the program and set its owner to root,. Why can"t you access / etc/shadow? when executed as an ordinary user? Is it possible that exec doesn"t inherit the suid property when it executes a new program?

// encapsulation.c
-sharpinclude <stdio.h>
-sharpinclude <stdlib.h>
-sharpinclude <unistd.h>
-sharpinclude <sys/types.h>

int main(){
    printf("uid is %d\n", getuid());
    printf("euid is %d\n", geteuid());
    execlp("/bin/sh", "sh", "-c","echo $UID $EUID;/bin/cat /etc/shadow", (char*)NULL);
    return 0;
}


  test gcc encapsulation.c -o encapsulation 
  test ./encapsulation 
uid is 1000
euid is 1000

/bin/cat: /etc/shadow: Permission denied
  test sudo chown root:root encapsulation
[sudo] password for inovker: 
  test ./encapsulation 
uid is 1000
euid is 1000

/bin/cat: /etc/shadow: Permission denied
  test sudo chmod u+s encapsulation
  test ./encapsulation 
uid is 1000
euid is 0

/bin/cat: /etc/shadow: Permission denied
  test sudo ./encapsulation 
uid is 0
euid is 0

root:!:17655:0:99999:7:::
daemon:*:17647:0:99999:7:::
bin:*:17647:0:99999:7:::
sys:*:17647:0:99999:7:::
sync:*:17647:0:99999:7:::
games:*:17647:0:99999:7:::
man:*:17647:0:99999:7:::
...
Mar.09,2021

for security reasons, bash checks euid and uid, and switches back when it is different, so Permission denied appears.

The implementation of

can be found in uidget and disable_priv_mode in the bash code.

The

workaround is to turn on privileged mode using bash's -p .

execlp("/bin/sh", "sh", "-p", "-c","echo $UID $EUID;/bin/cat /etc/shadow", (char*)NULL);

or call cat directly without bash,.


suid is only valid for binary executable programs. If you set 4755 permissions to the compiled encapsulation , then you should directly . / encapsulation execute valid

.
Menu