3 ms·
What if the real and effective user IDs do not match? Would it be necessary to make a consideration for such a case?
by zzo38computer 4y ago
What if the real and effective user IDs do not match? Would it be necessary to make a consideration for such a case?
- kazinator 4y agoThanks for raising the question. The code should probably be using the effective and not the real ID. We are not answering the question "is this path safe for the user who started this process", because that is not relevant. We need to know "is this path safe relative to the privilege and scope of the identity we are actually wielding to access the system". The access function in POSIX uses the real ID; but that is because its purpose is to determine, in a setuid program, what the original user can/cannot access. (In situations when it would be cumbersome to temporarily change the effective ID to the real one to try the actual access.) The real ID should not be used for checks which are not access checks, but rather "how can the environment harm me". The effective user does not trust the real user. Concretely, a setuid root binary run by user "bob" doesn't want to trust a symlink or directory that is modifiable by "bob". (If it wants to do such a trust check on behalf of "bob", it can call seteuid(getuid()) to become "bob" first).