IMPORTANT NOTE: the task described in the original question can be achieved in a safe way using sudo and sudoers configurations. Regardless of negative votes, this answer is going to stay for people that are still committed in running scripts with setuid, also after being warned of security implications. The method described also put bases for writing a more robust treatment of environment, like the one in sudo. Suggestions are welcome in chat.
The below shell script will create an a native wrapper with setuid and a given script embedded.
DISCLAIMER: READ CAREFULLY
To use the following snippet in a safe manner, some assumptions are necessary:
- the setuid executables created must be read only;
- the embedded script should be trusted and not being able to create security holes, such as execute another arbitrary script in the filesystem;
- The interpreter of your script, ant the script itself, should not be sensitive to environment manipulation attacks, such as modifying environment variables to force execution of untrusted code;
- The system is not already compromised, such as executables in system
PATH reachable directories were already replaced with malicious versions.
If you can't guarantee the above conditions, or if you don't accept the security risks involved in being able to run trusted or non-trusted scripts with setuid, stop reading now. Also the native wrapper is probably incomplete at mitigating some common environment manipulation attacks, so use it at your own risk. Suggestions to improve the code are welcome.
If you read the above warning, and you think you'll be able to guarantee the above conditions, or you can ensure safety of your system by other means, create a file create-setuid-wrapper.sh as it follows:
#!/usr/bin/env bash
set -e
if [[ `id -u` != 0 ]]; then
echo "Execute this command with super user credentials"
exit 1
fi
if [[ $# -ne 1 || ! -f $1 ]]; then
echo "A file argument is necessary"
exit 1
fi
INPUT=$1
TEMPFOLDER=/tmp/tmpsuidwrapper
TEMPINPUT=$TEMPFOLDER/input.data
TEMPINPUTOBJ=$TEMPFOLDER/input.o
WRAPPERSRC=$TEMPFOLDER/wrapper.c
OUTFILE=$(basename -- "$INPUT")
OUTFILE="${OUTFILE%.*}.bin"
# Create temporary directory and copy the input
mkdir -p $TEMPFOLDER
cp $INPUT $TEMPINPUT
# Write wrapper source
cat > $WRAPPERSRC <<- EOF
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <err.h>
#include <errno.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/wait.h>
extern const char _binary_input_data_start[];
extern void* _binary_input_data_size;
int main (int argc, char *argv[])
{
int rc = setuid(0);
if (rc == -1)
{
perror("setuid failed");
return -1;
}
int fd = memfd_create("script", 0);
if (fd == -1)
{
perror("memfd_create failed");
return -1;
}
size_t size = (size_t)&_binary_input_data_size;
rc = write(fd, _binary_input_data_start, size);
if (rc == -1)
{
perror("write failed");
return -1;
}
// Clean the environment to protect from some common
// environment manipulation attacks
// CHECK-ME: Check if some variables unset is actually needed
// and if more variables should be unset, sanitize
unsetenv("LD_LIBRARY_PATH");
unsetenv("LD_PRELOAD");
unsetenv("BASHENV");
unsetenv("ENV");
setenv("PATH", "${PATH}", 1);
pid_t pid = fork();
if (pid == 0)
{
// Child process, execute the script
{
const char * const argv[] = { "script", NULL };
const char * const envp[] = { NULL };
int rc = fexecve(fd, (char * const *) argv, (char * const *) envp);
if (rc == -1)
{
perror("fexecve failed");
return -1;
}
}
}
if (pid == -1)
{
perror("fork failed");
return -1;
}
// Parent process
wait(NULL);
return 0;
}
EOF
# NOTE: Crappy 'ld' syntax apparenty doesn't allow to
# specify a name for the symbol being created, so it will
# use path as the name. We move the input to temp folder
# to keep the symbol name short
CWD=`pwd`
cd $TEMPFOLDER
# Create a linkable object with the data to be embedded
ld -r -b binary -o input.o input.data
cd $CWD
# Compile the program and set setuid
cc -fPIC -no-pie -o $OUTFILE $WRAPPERSRC $TEMPINPUTOBJ
chmod 4755 $OUTFILE
# Cleanup
rm -fr $TEMPFOLDER
Then prepare, as an example, a test.py script like the following:
#!/usr/bin/env python3
import getpass
print(getpass.getuser())
Call create_setuid_wrapper.sh with the above test.py . The script will produce an executable test.bin. Ensure your system allow execution of arbitrary executables with setuid (SELinux enabled systems will not). Execution will print root or the name of your super user.
EDIT1: Removed copy to temporary file on the setuid executable. Now the embedded script is just executed directly from memory with a fork and a fexecve.
EDIT2: Attempt to clean the environment from some common environment manipulation attacks. It may be wrong and/or insufficient.
