[PATCH] libbb: Only setgid/setuid when necessary

[Denys Vlasenko]

On Mon, Jul 10, 2017 at 8:14 PM, Steven McDonald
<steven at steven-mcdonald.id.au> wrote:
> On Mon, 10 Jul 2017 09:17:09 +0200
> Denys Vlasenko <vda.linux at googlemail.com> wrote:
>
>> * Don't check for errors: in normal use, they are impossible
>
> I don't think this is correct. From setuid(2):
>
>> EAGAIN
>>    The uid does not match the current uid and uid brings process over
>>    its RLIMIT_NPROC resource limit.
>
> This would enable a trivial privilege elevation to root attack on a
> system with setuid busybox. All the user needs to do is fork a lot of
> processes up to RLIMIT_NPROC, and then have one of them exec busybox's
> ash.

Trying.

# chmod u+s,go=rX -c busybox
# ls -l busybox
-rwsr-xr-x 1 root root 914500 Jul 11 17:28 busybox

# chpst -p 2 -u 1:1 ./busybox ash <- run ash under UID=1, set RLIMIT_NPROC=2
$ ./busybox ash <- run another ash under UID=1
$ ./busybox ash <- try to run third ash under UID=1
ash: can't fork
$

This does not work because fork() in second UID=1 process fails,
and we can't reach the step where we can exec a setuid binary.

Moreover, if I run another ash under uid 1 from another root shell:

# chpst -u 1:1 ./busybox ash
$

it succeeds, but gets UID=1 again, it does not stay at UID=0 from suid.

If I run another ash under uid 1 from another root shell:
with RLIMIT_NPROC=2, this circumvents fork() problem,
we reach exec():


# chpst -p 2 -u 1:1 ./busybox ash
chpst: can't execute './busybox': Resource temporarily unavailable
#

and yet, kernel still not allows it.