Date: Sat, 17 Jan 2009 23:36:37 +0100 From: Jilles Tjoelker <jilles@stack.nl> To: Chris Palmer <chris@noncombatant.org> Cc: freebsd-security@freebsd.org Subject: Re: Incorrect (?) documentation for setreuid(2) could lead to security issues for user code Message-ID: <20090117223637.GA84044@stack.nl> In-Reply-To: <20090109062026.GI38127@noncombatant.org> References: <20090109062026.GI38127@noncombatant.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jan 08, 2009 at 10:20:26PM -0800, Chris Palmer wrote: > According to section 6.4.1 of "Setuid Demystified": > http://www.cs.ucdavis.edu/~hchen/paper/usenix02.html > FreeBSD 4.4's setreuid(2) man page is wrong. The man page for FBSD 7 says > the same thing. Is it still wrong, or was the implementation changed to > match the documentation? > This person noticed the same problem for OBSD: > http://www.nabble.com/setreuid()-documentation-is-confusing-and-wrong-td7953251.html Yes, it is still wrong. From reading the source: The conditions without root privs are: the ruid parameter must be -1, the old real uid or the old saved uid; the euid parameter must be -1, the old real uid, the old effective uid or the old saved uid. (The man page has this wrong.) The effect on the saved uid is: if the ruid parameter is not -1 or the new effective uid differs from the new real uid, the saved uid is set to the new effective uid. (Note that this means that specifying the real uid for ruid is subtly different from specifying -1, and also that setreuid(-1,-1) is not a no-op.) (The man page describes this in a confusing manner.) The main application for setreuid() nowadays probably is that setreuid(X,X) is a more portable way to drop all uid privileges. setuid(X) is particularly nasty because on SysV it may succeed without having dropped all privileges (hence, the recommendation in the man page seems inappropriate). setresuid(X,X,X) is nice because the setresuid() function is easy to understand and consistent in general, but unfortunately not as portable. Swapping real and effective UIDs to relinquish privileges temporarily is inferior to seteuid(). -- Jilles Tjoelker
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090117223637.GA84044>