setuid program

[relz]

Hi,

I'm trying to run a simple setuid program on Linux. I know that shell scripts aren't allowed to setuid, so I wrote a simple C file to do the job (yes I know it's not wise to use the system() command, it's just for testing purposes).
This is the code:

#include <unistd.h> 
#include <sys/types.h> 

int main (int argc, char *argv) {
  printf(&quot; When I invoke getuid I get: %d\n&quot;, getuid());
  system (&quot;ls ~relz/temp/locked_dir&quot;);
  return 0;
}

And the permissions are:
-rwsr-xr-x 1 relz arzey setuid_prog*

It is supposed to print the effective user-id, and then list the files in a directory accesible only by the owner "relz".

But when I run this program from another user, I get his user-id returned, and of course the directory can't be listed because of "permission denied".

What am I doing wrong?

 

[iribach]

a) if you want run a setuid prg, the prg has to be
ownet and setuid by root
b) sure you can check the user

user = get(e)uid();
if(user != whatiexpect) exit(1)
do the job....
exit(0);

 

[relz]

Thanks for the reply iribach,

Are you saying that setuid programs can only be written by the root ? That sounds strange, what if a different user wants to grant privelage to his files. For example in my case I'm in a univresity network, so obviously I won't get root permissions, but still I would like my friends to have access through a setuid program.

 

[iribach]

no, i say anly root can change uid without asking for pwd
in the example:

#define USER 11111 /* assumed this is your user-id */
/* this define is really dirty, use getpwnam() instead */

user = get(e)uid(); /* remember the calling user */
/* enter the critical step */
/* this only works by setuid-root */
if(setuid(USER)) exit(1);
do the root job....
if(setuid(user)) exit(1); /* should never happen, you are root, but if the user was deleted by another process ... */
do the normaluser job
exit(0);

-------

to allow your friends to access files owned by you, if they are in the same group like you, chmod 775 filename,
ask your admin to include you and friends in a same group.
this is the unix way to do it