2

Are setuid executables in Linux not allowed to use swap area? I read a security-related book which states that Setuid programs can not have memory they use written to disk. which came as a surprise to me.

8
  • How old is this book? In ye past the sticky bit used to be for locking an application into memory.
    – Hennes
    Oct 14, 2016 at 11:03
  • It's from 2006. So as I understood from your comment this is no longer true and setuid executables also use swap area?
    – Martin
    Oct 14, 2016 at 11:10
  • It would be easy enough to test this behavior: Write a small program that allocates large blocks of memory and fills them with something; then run that program as setuid vs non-setuid while watching memory and swap usage. What research have you done to try to answer the question yourself before posting it here?
    – user
    Oct 14, 2016 at 11:15
  • 1
    I seem to have swapped suid and sticky in my mind. For sticky see unix.stackexchange.com/questions/79395/… and the third comment. For suid, it will be interesting to see the answer.
    – Hennes
    Oct 14, 2016 at 11:18
  • @Hennes: and the sticky bit doesn't do what you think either. What sticky bit does is to tell the OS to keep frequently program in memory after the program terminates, for faster reloading. It doesn't prevent the program from getting swapped. Modern OS have disk cache which caches program as well as data without needing sticky bit.
    – Lie Ryan
    Oct 14, 2016 at 14:40

1 Answer 1

3

When programs want to mark a specific area of memory as must not be swappable for performance or security reason, they can use mlock() system call or mmap() with MAP_LOCKED. Note that mlock()ed memory can still be written to disk if you suspend to disk (a.k.a. hibernate); to be able to securely suspend to disk, you would need to set up encrypted swap and/or full disk encryption. Also, while core dump is often disabled by default on many distros, if you enable core dump, mlock()ed memory can also be core dumped, program can use MADV_DONTDUMP or coredump_filter to tell the kernel not to include certain memory from the core dump.

I can't find any reference anywhere in POSIX setuid() manpage or Linux setuid() manpage that specified that setuid program is automatically not allowed to swap.

The closest sentence that might resemble the book's claim, from Linux setuid() manpage, is "If uid is different from the old effective UID, the process will be forbidden from leaving core dumps."

2
  • 2
    Another true statement that could have been misinterpreted this way: a program may need to be setuid root to gain the ability to call mlock or mlockall. Regular users can only lock a small amount of memory.
    – user54862
    Oct 14, 2016 at 17:41
  • 1
    @Wumpus Q. Wumbley: to be precise, you don't necessarily need to actually be root to have unfettered access to mlock()ed memory. If you have CAP_IPC_LOCK capability, you can mlock/mlockall any amount of memory.
    – Lie Ryan
    Oct 14, 2016 at 18:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .