on ocaml and set-user-id programs

on ocaml and set-user-id programs

[Stefano Zacchiroli]

I've wrote an ocaml program that needs to be executed set-user-id root.

I managed to have it being executed with effective user id 0 only
compiling in native code or in custom bytecode. Both executing it as a
script using "ocamlrun ocaml" and compiling it to non-custom bytecode
make the program having effective user id of the user executing it.
(Example session at the end of this mail)

This behaviour is annoying and makes impossible to run ocaml set-user-id
programs where the native code compiler isn't available. Am I missing
something or is this a shortcoming of the current ocaml interpreter?

Thanks in advance,
Cheers.

          Attempt using ocamlrun ocaml (FAILED)
  
  $ cat a.ml
  #!/usr/bin/ocamlrun /usr/bin/ocaml
  #use "topfind";;
  #require "unix";;
  Printf.printf "UID = %d\nEUID = %d\n" (Unix.getuid ()) (Unix.geteuid ())
  $ su
  Password:
  # chown root a.ml
  # chmod 4755 a.ml
  # ls -l a.ml
  -rwsr-xr-x  1 root zack 143 2005-03-27 11:50 a.ml*
  # exit
  $ ./a.ml
  UID = 3148
  EUID = 3148
  $
  
          Attempt using non-custom bytecode (FAILED)
  
  $ cat b.ml
  Printf.printf "UID = %d\nEUID = %d\n" (Unix.getuid ()) (Unix.geteuid ())
  $ ocamlfind ocamlc -package unix -linkpkg -o b b.ml
  $ head -1 b
  #!/usr/bin/ocamlrun
  $ su
  Password:
  # chown root b
  # chmod 4755 b
  # ls -l b
  -rwsr-xr-x  1 root zack 70145 2005-03-27 11:52 b*
  # exit
  $ ./b
  UID = 3148
  EUID = 3148
  
          Attempt using custom bytecode (OK)
  
  $ ocamlfind ocamlc -custom -package unix -linkpkg -o b b.ml
  $ su
  Password:
  # chown root b
  # chmod 4755 b
  # exit
  $ ./b
  UID = 3148
  EUID = 0
  
          Attempt using native code (OK)
  
  $ ocamlfind opt -package unix -linkpkg -o b b.ml
  $ su
  Password:
  # chown root b
  # chmod 4755 b
  # exit
  $ ./b
  UID = 3148
  EUID = 0

-- 
Stefano Zacchiroli -*- Computer Science PhD student @ Uny Bologna, Italy
zack@{cs.unibo.it,debian.org,bononia.it} -%- http://www.bononia.it/zack/
If there's any real truth it's that the entire multidimensional infinity
of the Universe is almost certainly being run by a bunch of maniacs. -!-

Re: [Caml-list] on ocaml and set-user-id programs

[Richard Jones]

On Sun, Mar 27, 2005 at 12:01:45PM +0200, Stefano Zacchiroli wrote:
> I've wrote an ocaml program that needs to be executed set-user-id root.
> 
> I managed to have it being executed with effective user id 0 only
> compiling in native code or in custom bytecode. Both executing it as a
> script using "ocamlrun ocaml" and compiling it to non-custom bytecode
> make the program having effective user id of the user executing it.
> (Example session at the end of this mail)

I think the problem is simply caused because your kernel has setuid
scripts disabled, for security reasons.  According to the second
reference below, Linux ignores the setuid and setgid bits on scripts.

http://www.faqs.org/faqs/unix-faq/faq/part4/section-7.html
http://www.linux.com/howtos/Secure-Programs-HOWTO/processes.shtml

Rich.

-- 
Richard Jones, CTO Merjis Ltd.
Merjis - web marketing and technology - http://merjis.com
Team Notepad - intranets and extranets for business - http://team-notepad.com

Re: [Caml-list] on ocaml and set-user-id programs

[Kim Nguyen]

Le dimanche 27 mars 2005 à 12:01 +0200, Stefano Zacchiroli a écrit :
> I've wrote an ocaml program that needs to be executed set-user-id root.
> 
> I managed to have it being executed with effective user id 0 only
> compiling in native code or in custom bytecode. Both executing it as a
> script using "ocamlrun ocaml" and compiling it to non-custom bytecode
> make the program having effective user id of the user executing it.

Yes. The linux kernel (and maybe other unices but i'm not sure) disable
the setuid bit for shell scripts since it's really unsecure. Perl
circumvents this by having a setuid binary wrapper that does some extra
security check and launch the scripts (which inherits the privileges of
the setuid wrapper). See perlsec documentation for more details.
(This explain why the custom byte code works, since it's a binary that
embeds both the script and the interpreter).

> This behaviour is annoying and makes impossible to run ocaml set-user-id
> programs where the native code compiler isn't available. 

Indeed. Maybe the ocaml distribution could provide such a wrapper.

Hope this helps,
-- 
Kim

Re: [Caml-list] on ocaml and set-user-id programs

[Stefano Zacchiroli]

On Sun, Mar 27, 2005 at 12:31:57PM +0200, Kim Nguyen wrote:
> Yes. The linux kernel (and maybe other unices but i'm not sure) disable
> the setuid bit for shell scripts since it's really unsecure. Perl
> circumvents this by having a setuid binary wrapper that does some extra
> security check and launch the scripts (which inherits the privileges of

Indeed I was fooled by perl's behaviour since I made test with it and I
managed to have an effective user id of 0 on setuid perl scripts. Since
I managed to do so without passing "-U" to the interpreter I assumed
that was the "normal" behaviour. Now I've just tried with python that
works as ocaml indeed.

> > This behaviour is annoying and makes impossible to run ocaml set-user-id
> > programs where the native code compiler isn't available. 
> Indeed. Maybe the ocaml distribution could provide such a wrapper.

Yes, it would be cool.

Thanks to who replied.
Cheers.

-- 
Stefano Zacchiroli -*- Computer Science PhD student @ Uny Bologna, Italy
zack@{cs.unibo.it,debian.org,bononia.it} -%- http://www.bononia.it/zack/
If there's any real truth it's that the entire multidimensional infinity
of the Universe is almost certainly being run by a bunch of maniacs. -!-

Re: [Caml-list] on ocaml and set-user-id programs

[Richard Jones]

On Sun, Mar 27, 2005 at 03:34:23PM +0200, Stefano Zacchiroli wrote:
> On Sun, Mar 27, 2005 at 12:31:57PM +0200, Kim Nguyen wrote:
> > Indeed. Maybe the ocaml distribution could provide such a wrapper.
> Yes, it would be cool.

There are many pitfalls to calling a setuid process (in general, not
just scripts).  For instance several years ago I wrote a setuid
program and I was pretty sure I'd covered every base.  But then I
discovered that signal handler masks actually get inherited across
exec(2), so if your program depends on signals, then it could fail if
someone passed an unexpected signal mask.  There are so many of these
strange dependencies (IFS, PATH, signals, BSD resources, ...) that I
like the userv[1] approach which bypasses the problems entirely.
Either that, or use sudo which is at least well understood.

Rich.

[1] http://www.chiark.greenend.org.uk/~ian/userv/

-- 
Richard Jones, CTO Merjis Ltd.
Merjis - web marketing and technology - http://merjis.com
Team Notepad - intranets and extranets for business - http://team-notepad.com