search

hilbix / suid

run programs and scripts suid
Other
0 stars 0 forks source link

Security BUG: suid leaks groups #26

Open hilbix opened 6 months ago

hilbix commented 6 months ago

suid has a bug that it does leak the groups of the original user.

x1@yeti:~$ id
uid=1002(x1) gid=1002(x1) groups=1002(x1)

x1@yeti:~$ cat /etc/suid.conf.d/tino.conf 
tino::tino:tino:-:/home/tino:/bin/bash:-lc:debian_chroot='suid' LOGNAME=tino USER=tino HOME=/home/tino "$@" ${*-/bin/bash -l}:-bash

x1@yeti:~$ suid tino

(suid)tino@yeti:~$ id
uid=1000(tino) gid=1000(tino) groups=1000(tino),1002(x1)

The group x1 should not be present in the forked bash!