Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I have a user on a unix system where Im allowed to create new files, what prevents me from downloading an executable file onto that system which is already SUID'ed to root on a different system?

Scenario:

  • I'm logged into a shell with my user Karrax (box1)
  • On a different system (box2) where I'm already root I set SUID root on an executable
  • I then transfer/copy the file over to box1

What prevents this file from running as root on the first shell I logged into?

share|improve this question
2  
This is documented in the chmod(1) man page. –  Alex Holst Dec 30 '10 at 18:13
    
you might want to recheck your accepted answer - seems he changed the content... –  AviD Jan 2 '11 at 0:30
add comment

3 Answers

up vote 12 down vote accepted

When you copy a file to a different filesystem, what's going on under the hood is that a you create a new file and copy the contents. Moving a file to a different filesystem is done by copying then removing the source. So you have no more privileges when copying a file than at any other time you're creating a file.

When you create a file, it belongs to you. Many unix variants restrict changing the owner (chown) to root. Even those that allow the owner of a file to give it away clear the setuid and setgid bits when doing so. Group ownership changes (chgrp) also clear away the setxid bits unless invoked with root privileges. And you need to own the file or be root to change its permissions. So you can't create a setxid file for a user or group you don't have permission to run programs as.

A different vector for setxid file injection is filesystem mounting. Most configurations only allow the setxid bits on filesystems directly mounted by root (as opposed /etc/fstab entries with the user option on Linux, Samba, FUSE, …). Sometimes, for example with NFS mounts, it's up to the system administrator to ensure that filesystems are mounted with the nosuid option.

share|improve this answer
add comment

You get close to this behavior when you download someone's tarball and extract it, 'preserving ownership/permissions' if the uid is 7544 you will see that uid for the files you untar if you are root, likely errors if your a non privileged user.

share|improve this answer
add comment

UPDATE: please ignore my previous misguided answer, which I've edited out here to avoid confusing folks. Gilles has a much better answer, which I could incorporate here or rephrase, but he deserves the credit....

If you really want to see what I had before, you can as always find it in the edit history by clicking on the time of edit.

share|improve this answer
1  
Actually, you can set the SUID bit. You can't make it SUID to another user though, if you're not root. –  StasM Dec 31 '10 at 6:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.