setuid, change executive user

[Szalajski]

To change the executive user of my process to the user P_userName, I perform in the source file :

struct passwd *L_passwd = getpwnam(P_userName);
setuid(L_passwd->pw_uid);

The users on my system are (see attachement for details) : root:sms, smsdba:sms, sms_26:sms, smsop:sms.

Below the result of setuid function :

root:sms to smsdba:sms
-> OK (setuid returns 0)

smsop:sms to sms_26:sms
-> NOK (setuid returns -1)
errno set to EPERM

smsdba:sms -> sms_26:sms
-> NOK (setuid returns -1)
errno set to EPERM

The same behavior as far as current user is not root.

Why the executive user change does not work when initial user is not root ?

How to change the effective execution user to sms_26 if the process is launched by smsop from command line ?

See attached files : swlist, /etc/passwd appended

Thank you in advance

Best regards.

Alain

[A. Clay Stephenson]

If you want this to work, for example to set the uid of sms to that of sms_26, you must

first do a chown sms_26 myprog
anfd then set the setuid bit of the executable via chmod 4755 myprog. Then the setuid will work. You also have the option of using the setprivgrp command to grant PRIV_SETRUGID to certain users. Man 1m setprivgrp for details.

[Szalajski]

Thanks a lot.

[A. Clay Stephenson]

You should do a ls -l of your executable to make sure that the setuid bit is set.
It should look something like this:
-rwsr-xr-x 1 sms_26 smsgrp ... ... myprog

There is also a setgid bit (2000 octal) that has the equivalent role for groups should you need to also do a setgid() call.


If there were no such facility then anyone could become anyone else via the setuid() system call - not a very secure world.