setuid not working

Question

I was trying to learn how setuid works.

So I made a dummy program which just prints the current user:

#include<bits/stdc++.h>
using namespace std;


int main(){
    cout << system("id -a") << "\n";
    cout << system("whoami")  << "\n";
}

I compiled and created the executable my-binary under the user anmol:

-rwxrwxr-x 1 anmol anmol 9972 Feb  1 16:54 my-binary

Then, I set the setuid option using chmod +s:

-rwsrwsr-x 1 anmol anmol 9972 Feb  1 16:54 my-binary

If I execute it normally, I get the following output:

uid=1000(anmol) gid=1000(anmol) groups=1000(anmol),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),122(sambashare)
anmol

Now, if I change to another user using su user2, and then execute it, I get:

uid=1001(user2) gid=1001(user2) groups=1001(user2)
user2

And when I execute it using sudo ./my-binary, I get:

uid=1001(root) gid=1001(root) groups=1001(root)
root

As far as I understand, no matter how I run it, should I not get the 1st output everytime?

I checked other similar questions over here and some suggested me to check if the filesystem is mounted using nosuid option, so I executed mount | /dev/sda1 and got the output:

/dev/sda1 on / type ext4 (rw,relatime,errors=remount-ro,data=ordered)

Which means that this option is not enabled.

Any hints on why am I not getting the expected output?

Answer 1

The system(3) library function runs its command argument by passing it to /bin/sh -c, and the /bin/sh on Linux (either bash, dash or mksh) gives up any setuid or setgid privileges unless called with the -p option.

The bash manpage says:

If the shell is started with the effective user (group) id not equal to the real user (group) id, and the -p option is not supplied [...] the effective user id is set to the real user id.

With dash (the /bin/sh from Debian/Ubuntu), this is kind of new: it wasn't yet the case in Debian 9 Stretch (2017), and it's only a Debian-specific change, still not in the upstream sources as of 2020-02-04. bash has had this since its 2.X versions (first included in RedHat 7.X, 2000).

This is still not the case with other shells (ksh93, zsh, etc) or with the /bin/sh from other systems (OpenBSD, FreeBSD, Solaris; but not NetBSD where it was changed to work like bash).

If they have it, their privileged mode works differently than in bash: it's turned on by default when the shell is run in setuid mode, and you have to turn it off with set +p in order to have the shell drop the setuid privileges.

---

If you want to use system(), popen(), or run a shell or an executable shell script directly from your setuid binary, then you should give up any "split personality" and completely switch over to your real or effective credentials via setres[ug]id:

% cat a.cc
#include <unistd.h>
#include <stdlib.h>
int main(){
    uid_t euid = geteuid();
    setresuid(euid, euid, euid);
    system("id");
}
% c++ a.cc
% chmod u+s a.out
% ./a.out
uid=1002(fabe)
% su -c ./a.out
uid=1002(fabe)

---

If you want just to check that your binary really switched its effective credentials, do it directly, not by invoking an external program via system():

#include <iostream>
#include <unistd.h>
#include <pwd.h>
using namespace std;
int main(){
    uid_t euid = geteuid(); struct passwd *pw = getpwuid(euid);
    cout << "euid=" << euid;
    if(pw) cout << ", " << pw->pw_name;
    cout << endl;
}