Bug demo code

setresuid_bug.c (text/plain), 1.16 KB, created by Craig Lawson on 2006-01-04 22:02:09 UTC

/**
 * setresuid doesn't work!
 * demo code tries to change process euid to argv[1].
 * Configure a.out to be Set-UID root.
 */

#define _GNU_SOURCE
#include <unistd.h>
#include <stdlib.h>

main(int     argc,
     char ** argv) {
  if (argc < 2) {
    printf("Usage: %s UID\n", argv[0]);
    exit(1);
  }

  uid_t ruid, euid, suid;
  if (getresuid(&ruid, &euid, &suid) != 0) {
    perror("getresuid");
    exit(2);
  }
  printf("getresuid: ruid=%d  euid=%d  suid=%d\n", ruid, euid, suid);

  uid_t new_euid = (int) strtol(argv[1], 0, 0);
  printf("setresuid(..., euid=%d, ...)\n", new_euid);
  if (setresuid(-1, new_euid, -1) != 0) {
    perror("setresuid");
    exit(2);
  }

  printf("setresuid(0, euid=%d, 0)\n", new_euid);
  if (setresuid(0, new_euid, 0) != 0) {
    perror("setresuid");
    exit(2);
  }

  uid_t ruid2, euid2, suid2;
  if (getresuid(&ruid2, &euid2, &suid2) != 0) {
    perror("getresuid");
    exit(2);
  }
  printf("getresuid: ruid=%d  euid=%d  suid=%d\n", ruid2, euid2, suid2);

  printf("setresuid(ruid=%d, euid=%d, suid=%d)\n", ruid, euid, suid);
  if (setresuid(ruid, euid, suid) != 0) {
    perror("setresuid");
    exit(2);
  }

  puts("Done");
  exit(0);
}