Re: unable to attach to setuid program that as reverted it privilege

["Michael Potter" <pottmi at gmail dot com>]

On Jan 23, 2008 12:48 PM, Michael Potter <pottmi@gmail.com> wrote:
>
> On Jan 23, 2008 11:52 AM, Mark Kettenis <mark.kettenis@xs4all.nl> wrote:
> > > Date: Tue, 22 Jan 2008 13:59:48 -0600
> > > From: "Michael Potter" <pottmi@gmail.com>
> > >
> > > Gdb Crew,
> > >
> > > I get this error when attaching to a setuid program that has
> > > _given_up_ its root privilege setuid(getuid()):
> > >
> > > ---------------------
> > > x~> gdb -p 19484
> > > GNU gdb 6.5
> > > Copyright (C) 2006 Free Software Foundation, Inc.
> > > GDB is free software, covered by the GNU General Public License, and
> > > you are
> > > welcome to change it and/or distribute copies of it under certain
> > > conditions.
> > > Type "show copying" to see the conditions.
> > > There is absolutely no warranty for GDB.  Type "show warranty" for
> > > details.
> > > This GDB was configured as "i586-suse-linux".
> > > Attaching to process 19484
> > > ptrace: Operation not permitted.            <<<<<=================
> >
> > This is the only acceptable behaviour.  The program might have dropped
> > root priviliges but it might still hold resources acquired when it
> > still had those priviliges and you might be able to exploit those.
> >
> > You should be able to attach to the process as root.  If not, complain
> > to the Linux kernel people.
> >
> >
>
> You are my point for me.
> I really really really do not want to give me programmers the ability
> to run the debugger as root.
>
> I think disallowing the attach is the only acceptable _default_
> behavior; but I think I should be able to override that default when I
> am confident that my program does not hold any privileged resources.
>
> I will post to a Linux kernel list in a couple of days.  I posted here
> because I felt that I was likely to find someone who had the same
> problem in this group.
>
> If I have to allow the programmers to run the debugger as root I will
> have to wrap it in a script that will prevent them from attaching to
> any other process than the ones that I can programmaticaly identify as
> ok.  Is there any option on gcc that will disable gcc commands that
> might be used to attach to other processes once they have started gcc
> as root?

oops, my brain was thinking gdb, my fingers typed gcc.

>
> Thanks all for your thoughtful replies.
>
> --
> Michael Potter
>