My question is build on top of the answer of the question about SUID exploitation:
The person (official answer) is stating that:
Many popular implementations of sh drop privileges when they start up: they reset their effective UID to their real UID. This includes bash, dash, mksh and BusyBox sh, so on Linux you won't see anything else.
So my question is which shells don't perform such critical security checks?
I tested it on my Ubuntu machine (18.04) and it seems that all shells are implementing such security checks:
ubuntu@ubuntu: cat /etc/shells # /etc/shells: valid login shells /bin/sh /bin/bash /bin/rbash /bin/dash
If I run (make simplest possible check):
root@ubuntu: echo "secret" > root-file.txt root@ubuntu: cp /bin/bash /tmp/foo && chmod u+s /tmp/foo lowpriv@ubuntu: ./tmp/foo -c "cat root-file.txt"
I get for all shells (as expected):
cat: root-file.txt: Permission denied
So it works for all standard (shipped with Ubuntu) Ubuntu-shells.