setgid example – wall

As a great example of setgid binaries, take a look at the wall(1) utility, reproduced from the script's output for convenience:

-rwxr-sr-x 1 root tty        30792 Aug 14  2017 wall

The wall(1) program is used to broadcast any message to all users console (tty) devices (typically the sysad will do this). Now, to write to a tty device (recall, folks, Chapter 1, Linux System Architecture, and the if it's not a process, it's a file Unix philosophy), what permissions do we require? Let's take the second terminal tty2 device as an example:

$ ls -l /dev/tty2
crw--w---- 1 root tty 4, 2 Feb 19 18:04 /dev/tty2
$

We can see that to write to the preceding device we either require root or we must be a member of the tty group. Peek again at the wall(1) utility long listing; it's a setgid binary-executable file and the group membership is tty; so, when anyone runs it, the wall process runs with an effective group ID (EGID) of tty ! That solves the problem—no code. No fuss.

Here is a screenshot where wall is used:

In the foreground, there is an ssh connected (to an Ubuntu VM; you can see it in the background) terminal window. It issues the wall command as a regular user: because of the setgid tty, it works!

Now you can run the earlier script on a Fedora 27 on x86_64:

$ ./show_setuidgid.sh 1
------------------------------------------------------------------
System Information (LSB):
------------------------------------------------------------------
LSB Version: :core-4.1-amd64:core-4.1-noarch
Distributor ID: Fedora
Description: Fedora release 27 (Twenty Seven)
Release: 27
Codename: TwentySeven
kernel: 4.14.18-300.fc27.x86_64
------------------------------------------------------------------
Scanning various directories for (traditional) SETUID-ROOT binaries ...
------------------------------------------------------------------
Scanning /bin ...
------------------------------------------------------------------
Scanning /usr/bin ...
-rwsr-xr-x. 1 root root 52984 Aug 2 2017 at
-rwsr-xr-x. 1 root root 73864 Aug 14 2017 chage
-rws--x--x. 1 root root 27992 Sep 22 14:07 chfn
-rws--x--x. 1 root root 23736 Sep 22 14:07 chsh
-rwsr-xr-x. 1 root root 57608 Aug 3 2017 crontab
-rwsr-xr-x. 1 root root 32040 Aug 7 2017 fusermount
-rwsr-xr-x. 1 root root 31984 Jan 12 20:36 fusermount-glusterfs
-rwsr-xr-x. 1 root root 78432 Aug 14 2017 gpasswd
-rwsr-xr-x. 1 root root 36056 Sep 22 14:07 mount
-rwsr-xr-x. 1 root root 39000 Aug 14 2017 newgidmap
-rwsr-xr-x. 1 root root 41920 Aug 14 2017 newgrp
-rwsr-xr-x. 1 root root 39000 Aug 14 2017 newuidmap
-rwsr-xr-x. 1 root root 27880 Aug 4 2017 passwd
-rwsr-xr-x. 1 root root 27688 Aug 4 2017 pkexec
-rwsr-xr-x. 1 root root 32136 Sep 22 14:07 su
---s--x--x. 1 root root 151416 Oct 4 18:55 sudo
-rwsr-xr-x. 1 root root 27880 Sep 22 14:07 umount
------------------------------------------------------------------
Scanning /sbin ...
------------------------------------------------------------------
Scanning /usr/sbin ...
-rwsr-xr-x. 1 root root 114840 Jan 19 23:25 mount.nfs
-rwsr-xr-x. 1 root root 89600 Aug 4 2017 mtr
-rwsr-xr-x. 1 root root 11256 Aug 21 2017 pam_timestamp_check
-rwsr-xr-x. 1 root root 36280 Aug 21 2017 unix_chkpwd
-rws--x--x. 1 root root 40352 Aug 5 2017 userhelper
-rwsr-xr-x. 1 root root 11312 Jan 2 21:06 usernetctl
------------------------------------------------------------------
Scanning /usr/local/bin ...
------------------------------------------------------------------
Scanning /usr/local/sbin ...
------------------------------------------------------------------

Scanning various directories for (traditional) SETGID binaries ...
------------------------------------------------------------------
Scanning /bin ...
------------------------------------------------------------------
Scanning /usr/bin ...
-rwxr-sr-x. 1 root cgred 15640 Aug 3 2017 cgclassify
-rwxr-sr-x. 1 root cgred 15600 Aug 3 2017 cgexec
-rwx--s--x. 1 root slocate 40528 Aug 4 2017 locate
-rwxr-sr-x. 1 root tty 19584 Sep 22 14:07 write
------------------------------------------------------------------
Scanning /sbin ...
------------------------------------------------------------------
Scanning /usr/sbin ...
-rwx--s--x. 1 root lock 15544 Aug 4 2017 lockdev
-rwxr-sr-x. 1 root root 7144 Jan 2 21:06 netreport
------------------------------------------------------------------
Scanning /usr/local/bin ...
------------------------------------------------------------------
Scanning /usr/local/sbin ...
------------------------------------------------------------------
$

More setuid-root binaries seem to show up; also, write(1) is the equivalent (to wall(1)) setgid tty utility on Fedora.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.117.152.26