A simple question about suid

[hazel]

I was just curious to know: if I run a program which runs suid as root, and it crashes, what are my access rights at that point? Am I still root or do I go back to being myself as soon as the program is no longer running?

[RobinVossen]

Depends on how to crashes. But the App has the rights and the user not. So normally, no you won't be root.

[Rubberman]

However, since the program is running as root, if it spawns a new shell, I think that will run as root also. For example, it could spawn an xterm as a nohup'd background process with its output on a remote system, giving someone root access to your system. Then, if the program crashes or is killed, the spawned xterm/shell will continue to run. The lesson here is that one should be VERY careful what is tagged suid-root.

[hazel]

That's also a good reason not to give people sudo access to programs like vi that can spawn shells. But I had something a bit different in mind.

You read a lot about exploits in which crackers crash a server program by overloading its input buffers. I just wondered how this worked and whether crashing a program that is running with root permissions can in itself give you root access.

PS I hope it's not against forum rules to tell me !

[Rubberman]

That's also a good reason not to give people sudo access to programs like vi that can spawn shells. But I had something a bit different in mind.

You read a lot about exploits in which crackers crash a server program by overloading its input buffers. I just wondered how this worked and whether crashing a program that is running with root permissions can in itself give you root access.

PS I hope it's not against forum rules to tell me !

Not against the rules to discuss theory. I just don't think it would be good practice to provide functional code. Anyway, a lot of Linux and Unix services have to run as root, even such tools as 'passwd', which is suid-enabled because it has to update such files as /etc/shadow. So, daemons such as sshd, xinetd, ftpd CAN be vulnerable to remote buffer overflow attacks and grant the attacker root privileges. However, once logged in as a normal user, buffer overflow errors in non-suid programs [/I]generally[/I] cannot elevate your privileges.