can't write to a file as non root having setuid

sathishpy · 02-10-2009, 03:27 AM

On RHEL 5 upadte 3, I am seeing the following issue

#mkdir /newdir
#touch /newdir/file1
#chmod 06777 /newdir/file1

#su newuser
$dd if=/dev/null of=/newdr/file1
dd: opening '/newdir/file1': Operation not permitted

The result is same even with selinux disabled. This used to work on older releases clearing the setuid/setgid after the write. wondering whether it is an intended change or a bug.

skuzye · 02-10-2009, 06:08 AM

First, do a ls -l (lowercase "L") and see if the permissions are correct.

Skuzye

sathishpy · 02-10-2009, 06:30 AM

The permissions are correct and it is -rwsrwsrwx. As I mentioned the same steps works fine with rhel5 update 2, the issue is only with update 3.

theYinYeti · 02-10-2009, 06:34 AM

06777 doesn't exist. 0677 is OK, and 6777 too; I suppose the latter is your actual intent.

Yves.

sathishpy · 02-10-2009, 07:44 AM

both 06777 and 6777 works the same for chmod.

# chmod 06777 /newdir/file1
# ls -l /newdir/file2
-rwsrwsrwx 1 6777 root 0 Feb 10 09:30 /newdir/file1

camh · 02-10-2009, 01:36 PM

Perhaps a silly question, but does newuser have access to the /newdir directory itself? What are the permissions for /newdir?

sathishpy · 02-11-2009, 04:44 AM

Yes.

# ls -ld /newdir/
drwxrwxrwx 2 root root 4096 Feb 10 09:30 /newdir/
# ls -l /newdir/file1
-rwsrwsrwx 1 6777 root 0 Feb 10 05:16 /newdir/file1

sathishpy · 02-23-2009, 07:48 AM

This issue is due to RHEL5.3 patch BZ#463687 [kernel: open() call allows setgid bit when user is not in new file's group].