I have reversed the order of $EUID and $EGID in the two list context assignments at the begin and the end of the script for testing. [...] Perhaps Perl tries to be overly smart

Yes, this is what happens in the special-cased handling of list assignment at pp_hot.c:S_aassign_uid that I mentioned earlier: assignments to any of the four variables are deferred until the reset of the list assignment is complete, then they are explicitly assigned ($UID and $EUID) first, ($GID and $EGID) next. This is the aspect that one could most plausibly argue is buggy.

The bit that troubles me is that it is presumably not safe to assume that every such list assignment is aimed at dropping privileges; and in a world with ACLs, it maybe also be tricky to determine whether that's the intent. (The gist you link to, on the other hand, is specifically aimed at dropping privileges. In that context, "must setgid() before setuid()" makes perfect sense.)

... suid_wrapper ...

Thanks, I'll take a look at that: I've hand-crafted such suid wrappers in the past, but not in the last decade or two. If I get that far before you do, I'll write up an issue around this.

In reply to Re^4: Not understanding the code to drop privileges in perlsec by hv
in thread Not understanding the code to drop privileges in perlsec by Nocturnus

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.