Re: unable to attach to setuid program that as reverted it privilege

["Michael Potter" <pottmi at gmail dot com>]

On Jan 23, 2008 11:52 AM, Mark Kettenis <mark.kettenis@xs4all.nl> wrote:
> > Date: Tue, 22 Jan 2008 13:59:48 -0600
> > From: "Michael Potter" <pottmi@gmail.com>
> >
> > Gdb Crew,
> >
> > I get this error when attaching to a setuid program that has
> > _given_up_ its root privilege setuid(getuid()):
> >
> > ---------------------
> > x~> gdb -p 19484
> > GNU gdb 6.5
> > Copyright (C) 2006 Free Software Foundation, Inc.
> > GDB is free software, covered by the GNU General Public License, and
> > you are
> > welcome to change it and/or distribute copies of it under certain
> > conditions.
> > Type "show copying" to see the conditions.
> > There is absolutely no warranty for GDB.  Type "show warranty" for
> > details.
> > This GDB was configured as "i586-suse-linux".
> > Attaching to process 19484
> > ptrace: Operation not permitted.            <<<<<=================
>
> This is the only acceptable behaviour.  The program might have dropped
> root priviliges but it might still hold resources acquired when it
> still had those priviliges and you might be able to exploit those.
>
> You should be able to attach to the process as root.  If not, complain
> to the Linux kernel people.
>
>

You are my point for me.
I really really really do not want to give me programmers the ability
to run the debugger as root.

I think disallowing the attach is the only acceptable _default_
behavior; but I think I should be able to override that default when I
am confident that my program does not hold any privileged resources.

I will post to a Linux kernel list in a couple of days.  I posted here
because I felt that I was likely to find someone who had the same
problem in this group.

If I have to allow the programmers to run the debugger as root I will
have to wrap it in a script that will prevent them from attaching to
any other process than the ones that I can programmaticaly identify as
ok.  Is there any option on gcc that will disable gcc commands that
might be used to attach to other processes once they have started gcc
as root?

Thanks all for your thoughtful replies.

-- 
Michael Potter