2

I am upgrading an older SuSE-13.2 box to Leap-15. I have done a fresh Leap-15.0 install and ported over the source code that we ran on the 13.2 box. I builds fine but I am having an issue. The program is/has to be an suid program. It also uses fork/execvpe/wait to execute some external scripts. And that is where my problem lies. The user is a member of several groups but these group memberships seem to disappear when these external scripts are executed. For instance the user is a member of the cdrom group so he can eject and work with a DVD. I have created a simple example script and source for a programthat execvpes that script which shows my problem.

test.sh script:

#!/bin/sh
whoami
id

test.c program source:

#define _GNU_SOURCE
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main()
{
        char *path = getenv("PATH");
        char  pathenv[strlen(path) + sizeof("PATH=")];
        sprintf(pathenv, "PATH=%s", path);
        char *envp[] = {pathenv, NULL};
        char *tests[] = {"./test.sh", NULL};
        execvpe(tests[0], tests, envp);
}

Use:

#cc  test.c
#./a.out
markh
uid=5076(markh) gid=100(users) groups=100(users),19(floppy),200(lcrs),484(tape),485(lp),488(disk),489(dialout),490(cdrom)

Then as root:

#chown root ./a.out
#chgrp root ./a.out
#chmod +s ./a.out

Then as user

#./a.out
markh
uid=5076(markh) gid=100(users) groups=100(users)

Once the program is owned by root and suid, I lose all my group memberships for some unknown reason. It is not proper to me.

This all works fine on the old 13.2 box but does not on Leap 15 or Leap 42.3. I know this is not a SuSE linux place but I suspect it is not really SuSE linux related. It is not kernel related either as I am running a 4.16.12 kernel on both the 13.2 and 15.0 boxes.

Chris Davies
  • 116,213
  • 16
  • 160
  • 287
markh
  • 21
  • The code works on my Debian box, but that's small comfort I'm sure. So... what shell handles /bin/sh on your Leap system? I'd assume it's bash but it would be worth checking. Version number please? – Chris Davies Jun 01 '18 at 22:52
  • 1
    Yes, Leap uses bash for sh.My bash version on Leap is version 4.4.19 and my glibc version is 2.26. I have found a work around for this issue. I suspect it is a glibc thing but could certainly be bash. If I use setresuid and setresgid to set the real, effective, and saved uids and gids to the real uid and gid it works. So at least I have a work around for what I believe is a bug. – markh Jun 02 '18 at 16:28
  • 1
    I just learned that this is an opensuse specific issue with bash. It seems that one of "their" patches to bash has caused this issue. – markh Jun 03 '18 at 08:25

0 Answers0