jer@peora.UUCP (J. Eric Roskos) (02/28/85)
In the V7 kernel, the SUID code under the comment "set SUID/SGID protections" in sys1.c sets the uid for a SUID file only if u.u_uid != 0. Does anybody know why this is so? Consider a program that is running SUID root that execs a program (such as a queueing program for a spooler) which reads the standard input and writes a file. If the program is writing into a spool area, the program may be a SUID program which writes the file with protections of, say, 0600, expecting that another SUID program will be able to read it. But if these latter programs are supposed to set their user ids to something other than root, this won't work. Since maknod() fills in the file's i_uid with u.u_uid, the file will be created with owner root, and the program that is supposed to read it won't be able to. Exactly this happens in uucp. There is a fix by rti!trt in the UCB version of UUCP that tries to recover from this, but it only works if the ruid (and not just the euid) is root. If only the euid is root, the UUCP fix is not executed, and furthermore, making it work requires a series of steps that exactly simulates what would happen if the special case for uid==0 did not occur. Thus the question arises... why not do SUIDs for uid==0?
guy@rlgvax.UUCP (Guy Harris) (03/02/85)
> Thus the question arises... why not do SUIDs for uid==0?
Good question. 4.2BSD and System (III|V) both do. If there's any
problem caused by that, somebody better let us all know real fast.
I suspect it was a philosophical decision - they may not have liked
the idea that running a set-UID program lost root privileges instead of
gaining them.
Guy Harris
{seismo,ihnp4,allegra}!rlgvax!guyhenry@utzoo.UUCP (Henry Spencer) (03/02/85)
> In the V7 kernel, the SUID code under the comment "set SUID/SGID protections" > in sys1.c sets the uid for a SUID file only if u.u_uid != 0. > > Does anybody know why this is so? We concluded quite a long time ago that, whatever the intent of this code, the refusal to setuid for root was effectively a bug. We fixed it. No problems. I recommend that everyone else do so. -- Henry Spencer @ U of Toronto Zoology {allegra,ihnp4,linus,decvax}!utzoo!henry