4 ms·
From the setresuid(2) man page: > An unprivileged process may change its real UID, effective UID, and saved set‐user‐ID, each to one of: the current real UID,
by jwilk 6y ago
From the setresuid(2) man page:
> An unprivileged process may change its real UID, effective UID, and saved set‐user‐ID, each to one of: the current real UID, the current effective UID or the current saved set‐user‐ID.
accountsservice did something like setresuid(uid, uid, -1), which set both real and effective UIDs, but kept saved set‐user‐ID as root, so that it could re-gain root privileges later.
Setting EUID was the correct course of action; but setting real UID let the unprivileged user kill the process.
- steerablesafe 6y agoWould it have been possible to attach a debugger to accountsservice in this state and execute arbitrary code, including re-gaining root privileges?
- jwilk 6y agoVery good question. :-) No, you can't use ptrace(2) on a process that has changed its EUID. For details, see PR_SET_DUMPABLE in the prctl(2) man page.
- steerablesafe 6y agoGreat. I expected that possibly the real UID controlled this, it's good that it's not the case.
- YtvwlD 6y agoNo, you can't usually attach a debugger to a process (with Ubuntu's default settings).