Re: Changing user and GROUP id for security?

Here's my concept code -- is this the right way? $switchRealUID will be true by default.

sub switchUsers { my ($uname,$gname)=@_;
 $>=0;
 if($> != 0) {
  mlog('',"requested to switch to user/group '$uname/$gname' but canno
+t set effective uid to 0 -- quitting; uid is $>");
  die "requested to switch to user/group '$uname/$gname' but cannot se
+t effective uid to 0 -- quitting; uid is $>\n";
 }
 $<=0;
 if($gname) {
  my $gid = getgrnam($gname);
  if(defined $gid) {
   if($switchRealUID) {
    $(=$gid;
    if($(+0==$gid) {
     mlog('',"Switched real gid to $gid ($gname)");
    } else {
     mlog('',"Failed to switch real gid to $gid ($gname) -- real uid=$
+(");
    }
   }
   $)=$gid;
   if($)+0==$gid) {
    mlog('',"Switched effective gid to $gid ($gname)");
   } else {
    mlog('',"Failed to switch effective gid to $gid ($gname) -- effect
+ive gid=$) -- quitting");
    die "Failed to switch effective gid to $gid ($gname) -- effective 
+gid=$) -- quitting";
   }
  } else {
   mlog('',"Could not find gid for group '$gname' -- not switching eff
+ective gid -- quitting");
   die "Could not find gid for group '$gname' -- not switching effecti
+ve gid -- quitting";
  }
 }
 if($uname) {
  my $uid = getpwnam($uname);
  if(defined $uid) {
   if($switchRealUID) {
    $<=$uid;
    if($<==$uid) {
     mlog('',"Switched real uid to $uid ($uname)");
    } else {
     mlog('',"Failed to switch real uid to $uid ($uname) -- real uid=$
+<");
    }
   }
   $>=$uid;
   if($>==$uid) {
    mlog('',"Switched effective uid to $uid ($uname)");
   } else {
    mlog('',"Failed to switch effective uid to $uid ($uname) -- real u
+id=$< -- quitting");
    die "Failed to switch effective uid to $uid ($uname) -- real uid=$
+< -- quitting";
   }
  } else {
   mlog('',"Could not find uid for user '$uname' -- not switching effe
+ctive uid -- quitting");
   die "Could not find uid for user '$uname' -- not switching effectiv
+e uid -- quitting";
  }
 }
}
[download]

Comment on Re: Changing user and GROUP id for security? Download Code

Replies are listed 'Best First'.
Re: Re: Changing user and GROUP id for security? by jhanna (Scribe) on Jan 29, 2003 at 17:29 UTC
I've removed the $switchRealUID condition -- yes one will always want to switch the RealUID. However I'm still having problems testing this script. Changing real and effective UID is no problem. The problem is that I can CHANGE it BACK. Shouldn't that be against the rules, or am I missing something? john	[reply]
Re: Re: Changing user and GROUP id for security? by jhanna (Scribe) on Jan 29, 2003 at 20:43 UTC
I found the answer here: http://archive.develooper.com/perl5-changes@perl.org/msg06044.html Linux and BSD treat this slightly different, and the safe way is like this: `$< = $id; # real uid $> = $id; # effective uid $< = $id; # real uid $> = $id; # effective uid` [download] If you do it twice, beginning with the real then everybody is happy. So the final answer to my question is here: sub switchUsers { my ($uname,$gname)=@_; eval('getgrnam(root);getpwnam(root);'); if($@) { # windows pukes "unimplemented" for these -- just skip it mlog('',"Warning: uname and/or gname are set ($uname,$gname) but get +grnam / getpwnam give errors"); return; } $>=0; if($> != 0) { mlog('',"requested to switch to user/group '$uname/$gname' but canno +t set effective uid to 0 -- quitting; uid is $>"); die "requested to switch to user/group '$uname/$gname' but cannot se +t effective uid to 0 -- quitting; uid is $>\n"; } $<=0; if($gname) { my $gid = getgrnam($gname); if(defined $gid) { $)="$gid $gid"; if($)+0==$gid) { mlog('',"Switched effective gid to $gid ($gname)"); } else { mlog('',"Failed to switch effective gid to $gid ($gname) -- effect +ive gid=$) -- quitting"); die "Failed to switch effective gid to $gid ($gname) -- effective +gid=$) -- quitting"; } $(="$gid $gid"; if($(+0==$gid) { mlog('',"Switched real gid to $gid ($gname)"); } else { mlog('',"Failed to switch real gid to $gid ($gname) -- real uid=$( +"); } } else { mlog('',"Could not find gid for group '$gname' -- not switching eff +ective gid -- quitting"); die "Could not find gid for group '$gname' -- not switching effecti +ve gid -- quitting"; } } if($uname) { my $uid = getpwnam($uname); if(defined $uid) { # do it both ways so linux and bsd are happy $<=$uid; $>=$uid; $<=$uid; $>=$uid; if($>==$uid) { mlog('',"Switched effective uid to $uid ($uname)"); } else { mlog('',"Failed to switch effective uid to $uid ($uname) -- real u +id=$< -- quitting"); die "Failed to switch effective uid to $uid ($uname) -- real uid=$ +< -- quitting"; } if($<==$uid) { mlog('',"Switched real uid to $uid ($uname)"); } else { mlog('',"Failed to switch real uid to $uid ($uname) -- real uid=$< +"); } } else { mlog('',"Could not find uid for user '$uname' -- not switching effe +ctive uid -- quitting"); die "Could not find uid for user '$uname' -- not switching effectiv +e uid -- quitting"; } } } [download]	[reply] [d/l] [select]