Ubuntu中文论坛

发表于： **2009-03-31 17:59**

程序中创建一个子进程, 为了安全考虑, 参考网上资料, 将子进程用户和用户级设为nobody(id 皆为65534).

但是程序老是输出setgid fail. 为什么会这样.

环境: Ubuntu 8.10

代码：全选

theone@theone-desktop:~/test$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:102::/home/syslog:/bin/false
klog:x:102:103::/home/klog:/bin/false
hplip:x:103:7:HPLIP system user,,,:/var/run/hplip:/bin/false
avahi-autoipd:x:104:112:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
gdm:x:105:113:Gnome Display Manager:/var/lib/gdm:/bin/false
pulse:x:106:115:PulseAudio daemon,,,:/var/run/pulse:/bin/false
saned:x:107:118::/home/saned:/bin/false
messagebus:x:108:119::/var/run/dbus:/bin/false
polkituser:x:109:120:PolicyKit,,,:/var/run/PolicyKit:/bin/false
avahi:x:110:121:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
haldaemon:x:111:122:Hardware abstraction layer,,,:/var/run/hald:/bin/false
theone:x:1000:1000:theone,,,:/home/theone:/bin/bash

代码：全选

theone@theone-desktop:~/test$ cat processTest.c 
#include <stdio.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdlib.h>
#include <errno.h>

int main()
{
	pid_t child;
	int statue,i ;
	
	child = fork();
	puts("What's");
	puts("Then?");
	puts("Twice?");
	
	if(child == 0)
	{
		chroot("/usr");
		if(seteuid(65534) == -1)
		{
			puts("setuid fail");
			exit(0);
		}
		if(setegid(65534) == -1)
		{
			printf("%d", EPERM == errno);
			puts("setgid fail");
			exit(0);
		}
		printf("son %d\n",getpid());
	}
	else
	{
		printf("father %d my son is %d\n",getpid(),child);
	}
		
	return 0;
}

代码：全选

theone@theone-desktop:~/test$ gcc processTest.c 
theone@theone-desktop:~/test$ sudo ./a.out
What's
Then?
Twice?
1setgid fail
What's
Then?
Twice?
father 8364 my son is 8365

Ubuntu中文论坛

Ubuntu进程setgid问题求解答.

Ubuntu进程setgid问题求解答.