GNU bug report logs - #52481
chown of coreutils may delete the suid of file

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 52481 in the body.
You can then email your comments to 52481 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: "21625039" <21625039 <at> zju.edu.cn>
To: <bug-coreutils <at> gnu.org>
Subject: chown of coreutils may delete the suid of file
Date: Tue, 14 Dec 2021 10:49:37 +0800

[Message part 1 (text/plain, inline)]

I encountered a problem with chown on my fedora34 as the version of
coreutils is 8.32.

 

The reproduce process could see the steps blow:

[root <at> fedora ~]# ll test.txt

-rw-r--r--. 1 root root 0 Dec 13 21:13 test.txt

[root <at> fedora ~]# chmod 4750 test.txt

[root <at> fedora ~]# ll test.txt

-rwsr-x---. 1 root root 0 Dec 13 21:13 test.txt

[root <at> fedora ~]# chown root:root test.txt

[root <at> fedora ~]# ll test.txt

-rwxr-x---. 1 root root 0 Dec 13 21:13 test.txt

[root <at> fedora ~]# rpm -qa coreutils

coreutils-8.32-19.fc34.x86_64

[root <at> fedora ~]# cat /etc/fedora-release

Fedora release 34 (Thirty Four)

 

Looking forward to hearing from you!

Thanks.

 

[Message part 2 (text/html, inline)]

Message #8 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Kamil Dudka <kdudka <at> redhat.com>
To: 21625039 <21625039 <at> zju.edu.cn>
Cc: bug-coreutils <at> gnu.org, 52481 <at> debbugs.gnu.org
Subject: Re: bug#52481: chown of coreutils may delete the suid of file
Date: Tue, 14 Dec 2021 16:33:00 +0100

On Tuesday, December 14, 2021 3:49:37 AM CET 21625039 wrote:
> I encountered a problem with chown on my fedora34 as the version of
> coreutils is 8.32.
> 
> 
> 
> The reproduce process could see the steps blow:
> 
> [root <at> fedora ~]# ll test.txt
> 
> -rw-r--r--. 1 root root 0 Dec 13 21:13 test.txt
> 
> [root <at> fedora ~]# chmod 4750 test.txt
> 
> [root <at> fedora ~]# ll test.txt
> 
> -rwsr-x---. 1 root root 0 Dec 13 21:13 test.txt
> 
> [root <at> fedora ~]# chown root:root test.txt
> 
> [root <at> fedora ~]# ll test.txt
> 
> -rwxr-x---. 1 root root 0 Dec 13 21:13 test.txt

I believe this is already documented [1]:

    "The chown command sometimes clears the set-user-ID or set-group-ID
    permission bits. This behavior depends on the policy and functionality
    of the underlying chown system call, which may make system-dependent
    file mode modifications outside the control of the chown command."

Kamil

[1] https://www.gnu.org/software/coreutils/manual/html_node/chown-invocation.html

> [root <at> fedora ~]# rpm -qa coreutils
> 
> coreutils-8.32-19.fc34.x86_64
> 
> [root <at> fedora ~]# cat /etc/fedora-release
> 
> Fedora release 34 (Thirty Four)
> 
> 
> 
> Looking forward to hearing from you!
> 
> Thanks.

Message #18 received at 52481 <at> debbugs.gnu.org (full text, mbox):

From: Bob Proulx <bob <at> proulx.com>
To: 52481 <at> debbugs.gnu.org, 52481-submitter <at> debbugs.gnu.org
Subject: Re: bug#52481: chown of coreutils may delete the suid of file
Date: Fri, 17 Dec 2021 17:19:36 -0700

21625039 wrote:
> [root <at> fedora ~]# ll test.txt
> -rwsr-x---. 1 root root 0 Dec 13 21:13 test.txt
> 
> [root <at> fedora ~]# chown root:root test.txt
> [root <at> fedora ~]# ll test.txt
> -rwxr-x---. 1 root root 0 Dec 13 21:13 test.txt

That is a feature of the Linux kernel, OpenBSD kernel, and NetBSD
kernel, and I presume of other kernels too.  I know that traditional
Unix systems did not.  But this is done by the kernel as a security
mitigation against some types of attack.

For example a user might have a file which is in their own directory
tree.  It might be executable and setuid.  Then through a social
engineering attack they coerce root into copying the file or otherwise
taking ownership of the directory tree because they are hoping to make
use of the now newly chowned root file that is executable.

Therefore as a security mitigation implemented by the OS kernel the
setuid bit is removed when chown'ing files.  If this is truly desired
then the file can be chmod'd explicitly after chown'ing the file.

This is entirely a kernel behavior and not of chown(1).  This isn't
specific to chown(1) command line utility at all.  For example you can
test that the same behavior from the kernel exists when using any
programming language.  It will have the same behavior.  Without
Coreutils involved at all.

    # ll test.txt
    -rwsr-xr-x 1 rwp rwp 0 Dec 17 17:13 test.txt
    # perl -e 'chown 0, 0, "test.txt" or die;'
    # ll test.txt
    -rwxr-xr-x 1 root root 0 Dec 17 17:13 test.txt

Bob

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.