GNOME Bugzilla – Bug 345244
gamin does not work for SUID binaries
Last modified: 2018-07-01 08:48:08 UTC
If you have a binary that has its SUID bit set, it cannot monitor files using gamin (haven't tried if original FAM supports this, perhaps not). I've written a small test program that opens a fam connection and monitors the file passed as argv[1]. If the program is SUID root (i.e. chmod root:root famtest && chmod +s famtest), and is executed by a non-root user, it will shut down because gamin closes the socket (HUP received in the GIOChannel watch). If the program does setuid(geteuid()); then everything works as expected. This is gamin 1.1.7 on Ubuntu Dapper. Let me know if you need debugging output from gamin (I thing you'll be able to reproduce it using the attached test program)
Created attachment 67576 [details] Test case that exposes the problem Compile with: gcc famtest.c `pkg-config glib-2.0 --libs --cflags` -lfam -Wall -g -o famtest Then change its permissions to SUID root. Then run it as a normal user. (Uncomment line 26 and 27 to see that it works if uid==euid)
Created attachment 115542 [details] [review] Fix euid!=ruid problem and portability (for Solaris getpeerucred(3C)) This is a gamin euid patch: * Samba (effective uid is user's uid, but real uid is 0): + Use geteuid(2) instead of getuid(2) to check own privilege + gam_server: Drop privileges after fork if euid != ruid * Solaris: Use getpeerucred() to get peer's credentials
Created attachment 128300 [details] [review] gam_server: Drop privileges after fork if euid != ruid gam_server: Drop privileges after fork if euid != ruid for Samba and setuid commands support (effective uid is user's uid, but real uid is 0).
Created attachment 128301 [details] [review] gam_server: Use geteuid(2) instead of getuid(2) to check own privilege Use geteuid(2) instead of getuid(2) to check own privilege for Samba support (effective uid is user's uid, but real uid is 0).
gamin is not under active development anymore and has not seen code changes for many years. Its codebase has been archived: https://gitlab.gnome.org/Archive/gamin/commits/master Closing this report as WONTFIX as part of Bugzilla Housekeeping to reflect reality. Please feel free to reopen this ticket (or rather transfer the project to GNOME Gitlab, as GNOME Bugzilla is deprecated) if anyone takes the responsibility for active development again.