Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

su ne radi

99 views
Skip to first unread message

Vedran Furač

unread,
Oct 1, 2009, 3:42:03 PM10/1/09
to
Jedno početničko...

-rwsr-xr-x 1 root root 33K 2009-07-24 06:29 /bin/su
^
Su na roota radi!

% grep 100 /etc/groups
users:x:100:vedranf,foo,...

% groups
users adm dialout cdrom floppy audio src video plugdev

% groups foo
foo : users

% su foo
Password:
initgroups: Operation not permitted

$ strace -f su foo
[...]
setgroups(1, [100]) = -1 EPERM (Operation not permitted)
[...]

/ nije nosuid mountan, /etc/groups i /etc/passwd su world readable. User
foo je u ldap-u ako to išta znači. Pam_wheel ne koristim.

setgroups() sets the supplementary group IDs for the calling process.
Appropriate privileges (Linux: the CAP_SETGID capability) are required.
The size argument specifies the number of supplementary group IDs in
the buffer pointed to by list. EPERM - The calling process has insufficient
privilege.

CAP_SETGID?!

% zmodload zsh/cap
% getcap /bin/su


getcap: /bin/su: no data available

:D

Ponestaje mi ideja. Inače to je prije normalno radilo. Prestalo je
raditi kada sam kupio novu mašinu i veći dio /home & /etc kopirao sa
stare na novu.

Vedran Furač

unread,
Oct 1, 2009, 10:00:18 PM10/1/09
to
Vedran Furač wrote:

> Jedno početničko...

Hakeri moji...

http://img18.imageshack.us/i/nikakve.png/

:D

Luka Ćavara

unread,
Oct 2, 2009, 2:01:12 AM10/2/09
to

root@kanta:/etc/pam.d# cat su

#

# The PAM configuration file for the Shadow `su' service

#


# This allows root to su without passwords (normal operation)
auth sufficient pam_rootok.so

# Uncomment this to force users to be a member of group root
# before they can use `su'. You can also add "group=foo"
# to the end of this line if you want to use a group other
# than the default "root" (but this may have side effect of
# denying "root" user, unless she's a member of "foo" or explicitly
# permitted earlier by e.g. "sufficient pam_rootok.so").
# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
# auth required pam_wheel.so

# Uncomment this if you want wheel members to be able to
# su without a password.
# auth sufficient pam_wheel.so trust

# Uncomment this if you want members of a specific group to not
# be allowed to use su at all.
# auth required pam_wheel.so deny group=nosu

# Uncomment and edit /etc/security/time.conf if you need to set
# time restrainst on su usage.
# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
# as well as /etc/porttime)
# account requisite pam_time.so

# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
#
# parsing /etc/environment needs "readenv=1"
session required pam_env.so readenv=1
# locale variables are also kept into /etc/default/locale in etch
# reading this file *in addition to /etc/environment* does not hurt
session required pam_env.so readenv=1 envfile=/etc/default/locale

# Defines the MAIL environment variable
# However, userdel also needs MAIL_DIR and MAIL_FILE variables
# in /etc/login.defs to make sure that removing a user
# also removes the user's mail spool file.
# See comments in /etc/login.defs
#
# "nopen" stands to avoid reporting new mail when su'ing to another user
session optional pam_mail.so nopen

# Sets up user limits, please uncomment and read /etc/security/limits.conf
# to enable this functionality.
# (Replaces the use of /etc/limits in old login)
# session required pam_limits.so

# The standard Unix authentication modules, used with
# NIS (man nsswitch) as well as normal /etc/passwd and
# /etc/shadow entries.
@include common-auth
@include common-account
@include common-session


--
The more you categorize people, the more you isolate yourself.
(Greg Russell)

Zeljko Vrba

unread,
Oct 2, 2009, 2:20:33 AM10/2/09
to
Kaj, pa nismo mi tvoj 24/7 besplatni user-support. Da uletis s kojim
zanimljivijim problemom, mozda bi se nekome i dalo zaj* :P


kzendra

unread,
Oct 2, 2009, 2:19:38 AM10/2/09
to
On Fri, 02 Oct 2009 04:00:18 +0200, Vedran Furaďż˝ wrote:

> Vedran Furaďż˝ wrote:
>
>> Jedno po�etni�ko...


>
> Hakeri moji...
>
> http://img18.imageshack.us/i/nikakve.png/
>
> :D

A nisi jo sku�io da ljudi na ovoj grupi odgovaraju samo u radno vrijeme?
:-D

--
It ain't the fall that kills you
It's the sudden stop at the bottom.

http://www.opelclub.hr/

Vedran Furač

unread,
Oct 2, 2009, 3:39:50 AM10/2/09
to
Zeljko Vrba wrote:

Zanimljivo je... samo ti si programer pa... :)

Vedran Furač

unread,
Oct 2, 2009, 3:38:02 AM10/2/09
to
Luka Ćavara wrote:

> Vedran Furač wrote:
>> Vedran Furač wrote:
>>
>>> Jedno početničko...
>> Hakeri moji...
>>
>> http://img18.imageshack.us/i/nikakve.png/
>>
>> :D
>
> root@kanta:/etc/pam.d# cat su

Do u bajt identičan. :)

Luka Ćavara

unread,
Oct 2, 2009, 3:52:32 AM10/2/09
to
Vedran Furač wrote:
> Luka Ćavara wrote:

>> root@kanta:/etc/pam.d# cat su
>
> Do u bajt identičan. :)
>

A jesi probo guglat "su initgroups: Operation not permitted"
Izgleda da su mnogi imali taj problem

--
..cuz everybody's somebody's fool

Aleksandar Ivanisevic

unread,
Oct 2, 2009, 5:25:05 AM10/2/09
to
Vedran Furač <ved...@vedranf.mine.nu> writes:

Odi na tutuntu forum, tamo cijeli dan i noc ima nekoga za odgovarat na
pocetnicka pitanja.

--
Aj si ti taj svoj svepametni stav naguraj u guzicu kad već nemaš šta
drugo. Pun mi kufer vas koji mislite da ste pobrali svu pamet svijeta i da
morate svakom loncu poklopac biti. - kzendra, hr.comp.os.linux

Vedran Furač

unread,
Oct 2, 2009, 8:03:45 AM10/2/09
to
Aleksandar Ivanisevic wrote:

> Vedran Furač <ved...@vedranf.mine.nu> writes:
>
>> Vedran Furač wrote:
>>
>>> Jedno početničko...
>> Hakeri moji...
>>
>> http://img18.imageshack.us/i/nikakve.png/
>
> Odi na tutuntu forum, tamo cijeli dan i noc ima nekoga za odgovarat na
> pocetnicka pitanja.

Nije ubuntu...


Vedran Furač

unread,
Oct 3, 2009, 7:18:19 AM10/3/09
to
Luka Ćavara wrote:

> Vedran Furač wrote:
>> Luka Ćavara wrote:
>
>>> root@kanta:/etc/pam.d# cat su
>> Do u bajt identičan. :)
>>
>
> A jesi probo guglat "su initgroups: Operation not permitted"
> Izgleda da su mnogi imali taj problem

To je prvo što sam napravio. Većina je izgubila +s na /bin/su. Kod mene
to nije slučaj.

Igor Pozgaj

unread,
Oct 3, 2009, 8:30:34 AM10/3/09
to
On 2009-10-03, Vedran Fura?? <ved...@vedranf.mine.nu> wrote:
> Luka ??avara wrote:
>
>> Vedran Fura?? wrote:

>>> Luka ??avara wrote:
>>
>>>> root@kanta:/etc/pam.d# cat su
>>> Do u bajt identi??an. :)

>>>
>>
>> A jesi probo guglat "su initgroups: Operation not permitted"
>> Izgleda da su mnogi imali taj problem
>
> To je prvo ??to sam napravio. Ve??ina je izgubila +s na /bin/su. Kod mene
> to nije slu??aj.

Pretpostavljam da ne trosis SELinux, grsec, apparmor ili neku slicnu egzotiku?

--
Igor Pozgaj | ipozgaj at gmail.com (GTalk / MSN)
ICQ: 126002505 | http://fly.srk.fer.hr/~ipozgaj
PGP: 0xEF36A092 | http://ipozgaj.blogspot.com
fb, lfm, li, dA | http://twitter.com/ipozgaj

Vedran Furač

unread,
Oct 3, 2009, 10:35:32 AM10/3/09
to
Igor Pozgaj wrote:

> On 2009-10-03, Vedran Fura?? <ved...@vedranf.mine.nu> wrote:
>> Luka ??avara wrote:
>>
>>> Vedran Fura?? wrote:
>>>> Luka ??avara wrote:
>>>>> root@kanta:/etc/pam.d# cat su
>>>> Do u bajt identi??an. :)
>>>>
>>> A jesi probo guglat "su initgroups: Operation not permitted"
>>> Izgleda da su mnogi imali taj problem
>> To je prvo ??to sam napravio. Ve??ina je izgubila +s na /bin/su. Kod mene
>> to nije slu??aj.
>
> Pretpostavljam da ne trosis SELinux, grsec, apparmor ili neku slicnu egzotiku?

Grsec je zakon, ali ne. Ništa od toga. Su na roota radi bez problema, na
ostale usere ne.

Nikola Ostrun

unread,
Oct 3, 2009, 10:53:13 AM10/3/09
to
Vedran Furaďż˝ <ved...@vedranf.mine.nu> writes:

> Igor Pozgaj wrote:
>
>> On 2009-10-03, Vedran Fura?? <ved...@vedranf.mine.nu> wrote:
>>> Luka ??avara wrote:
>>>
>>>> Vedran Fura?? wrote:
>>>>> Luka ??avara wrote:
>>>>>> root@kanta:/etc/pam.d# cat su
>>>>> Do u bajt identi??an. :)
>>>>>
>>>> A jesi probo guglat "su initgroups: Operation not permitted"
>>>> Izgleda da su mnogi imali taj problem
>>> To je prvo ??to sam napravio. Ve??ina je izgubila +s na /bin/su. Kod mene
>>> to nije slu??aj.
>>
>> Pretpostavljam da ne trosis SELinux, grsec, apparmor ili neku slicnu egzotiku?
>

> Grsec je zakon, ali ne. Ni�ta od toga. Su na roota radi bez problema, na
> ostale usere ne.

A sljede�i program (suid, vlasnik root:root) ispi�e?

#include <sys/types.h>
#include <grp.h>
#include <unistd.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>

int
main(void)
{
gid_t g[] = { 500 };
setgroups(1, g);
printf("%s\n", strerror(errno));

return 0;
}


--
VI = Virtually Incomprehensible.

Vedran Furač

unread,
Oct 3, 2009, 11:33:41 AM10/3/09
to
Nikola Ostrun wrote:

> A sljedeći program (suid, vlasnik root:root) ispiše?


>
> #include <sys/types.h>
> #include <grp.h>
> #include <unistd.h>
> #include <errno.h>
> #include <stdio.h>
> #include <string.h>
>
> int
> main(void)
> {
> gid_t g[] = { 500 };
> setgroups(1, g);
> printf("%s\n", strerror(errno));
>
> return 0;
> }

Ne znam zašto si stavio 500, s obzirom da nema te grupe kod mene. No, u
svakom slučaju bez obzira na grupu, rezultat je isti: ispiše "success",
ali strace kaže:

setgroups(1, [100]) = -1 EPERM (Operation not permitted)

-rwsrwxrwx 1 root root 9,1K 2009-10-03 17:30 ./testsu
^

Nikola Ostrun

unread,
Oct 3, 2009, 12:02:52 PM10/3/09
to
Vedran Furaďż˝ <ved...@vedranf.mine.nu> writes:
> Ne znam za�to si stavio 500, s obzirom da nema te grupe kod mene. No, u
> svakom slu�aju bez obzira na grupu, rezultat je isti: ispi�e "success",
^^^^^^^
Cooooool

> ali strace ka�e:


> setgroups(1, [100]) = -1 EPERM (Operation not permitted)

�to je za o�ekivati jer strace(1)-a� suid program (osim ako ti sam
strace(1) nije suid program, a u tom slu�aju nemam pojma...).

Koju distru tro�i�? Koji su(1)? su sa tvog acca na tvoj acc radi?
Sa roota na vulgaris acc-ove? Recimo da skineďż˝ coreutils pa probaďż˝
taj su?

Vedran Furač

unread,
Oct 3, 2009, 2:35:53 PM10/3/09
to
Nikola Ostrun wrote:

> Vedran Furač <ved...@vedranf.mine.nu> writes:
>> ali strace kaže:


>> setgroups(1, [100]) = -1 EPERM (Operation not permitted)
>

> Što je za očekivati jer strace(1)-aš suid program (osim ako ti sam
> strace(1) nije suid program, a u tom slučaju nemam pojma...).

Nisam pojma imao.

> Koju distru trošiš?

Debian, što drugo.

> Koji su(1)?

Onaj iz login paketa. http://pkg-shadow.alioth.debian.org/

> su sa tvog acca na tvoj acc radi?

Nisam još probao. Evo:
vedranf@antares % su vedranf

Password:
initgroups: Operation not permitted

Ne. :)

> Sa roota na vulgaris acc-ove?

Radi.

> Recimo da skineš coreutils pa probaš
> taj su?

Pogledat ću.

Luka Ćavara

unread,
Oct 3, 2009, 3:22:52 PM10/3/09
to
Vedran Furač wrote:

<...>

Probaj probati reinstalirati paket login, u kojem je
sadržana izvršna datoteka /bin/su, /etc/pam.d/su i ostala
skalamerija:

apt-get install dpkg-repack
dpkg-repack login
apt-get clean
apt-get update
apt-get remove --purge login
apt-get install login

Drazen Kacar

unread,
Oct 3, 2009, 4:45:29 PM10/3/09
to
Vedran Furaďż˝ wrote:

> vedranf@antares % su vedranf
>
> Password:

Tu, prije nego �to stisne� enter, zaka�i strace kao root na su proces, pa
javi rezultate.

> initgroups: Operation not permitted

--
.-. .-. Yes, I am an agent of Satan, but my duties are largely
(_ \ / _) ceremonial.
|
| da...@fly.srk.fer.hr

Vedran Furač

unread,
Oct 4, 2009, 8:25:09 AM10/4/09
to
Luka Ćavara wrote:

Nije pomoglo.

Zanimljivo da ako ugasim nscd čak i su na root-a prestane raditi (su:
Authentication failure) kao i sudo (sudo: setreuid(ROOT_UID, user_uid):
Operation not permitted).

Nisam jedini: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545414

Moguće je da to ima veze s mojim originalnim problemom.

Vedran Furač

unread,
Oct 4, 2009, 8:44:49 AM10/4/09
to
Drazen Kacar wrote:

> Vedran Furač wrote:
>
>> vedranf@antares % su vedranf
>>
>> Password:
>

> Tu, prije nego što stisneš enter, zakači strace kao root na su proces, pa
> javi rezultate.

Nema nekih razlika. Evo bitnijih poziva, ako treba, pasteam sve negdje
na web:

27965 geteuid() = 0
27965 geteuid() = 0
27965 getuid() = 1000
27965 geteuid() = 0
27965 getuid() = 1000
27965 geteuid() = 0
27965 setuid(1000) = 0
27965 getuid() = 1000
27965 geteuid() = 1000
27965 setuid(0) = -1 EPERM (Operation not permitted)
27965 getuid() = 1000
27965 geteuid() = 1000
27965 getuid() = 1000
27965 geteuid() = 1000
27965 geteuid() = 1000
27965 getgid() = 100
27965 setgid(0) = -1 EPERM (Operation not permitted)
27965 setgid(100) = 0
27965 setgroups(1, [100]) = -1 EPERM (Operation not permitted)

Mladen Gogala

unread,
Oct 4, 2009, 9:30:03 AM10/4/09
to
On Sun, 04 Oct 2009 14:44:49 +0200, Vedran Furač wrote:

> 27965 setuid(0) = -1 EPERM (Operation not permitted)


Trebati ce ti jedan mali "chmod".


--
http://mgogala.freehostia.com

Nikola Ostrun

unread,
Oct 4, 2009, 9:36:04 AM10/4/09
to
Vedran Furaďż˝ <ved...@vedranf.mine.nu> writes:

> Drazen Kacar wrote:
>> Tu, prije nego �to stisne� enter, zaka�i strace kao root na su proces, pa


>> javi rezultate.
>
> Nema nekih razlika. Evo bitnijih poziva, ako treba, pasteam sve negdje
> na web:
>
> 27965 geteuid() = 0
> 27965 geteuid() = 0
> 27965 getuid() = 1000
> 27965 geteuid() = 0
> 27965 getuid() = 1000
> 27965 geteuid() = 0
> 27965 setuid(1000) = 0

^^^^^^^^^^^^
Buuuuuuum...

Tro�i� LDAP? Jesi probao za nekog lokalnog korisnika? Ugl. ak na�e�
funkciju koja napravi ovaj setuid(2), brijem da �e� sku�it u �emu je
problem (mislim da nije ba� jednostavno kad tro�i� pam).

Nikola Ostrun

unread,
Oct 4, 2009, 9:38:04 AM10/4/09
to
Mladen Gogala <mla...@bogus.email.invalid> writes:

> On Sun, 04 Oct 2009 14:44:49 +0200, Vedran Furaďż˝ wrote:
>
>> 27965 setuid(0) = -1 EPERM (Operation not permitted)
>
>
> Trebati ce ti jedan mali "chmod".

Eh, ali taj proces si je sam "metno" uid != 0.

Vedran Furač

unread,
Oct 4, 2009, 10:19:19 AM10/4/09
to
Nikola Ostrun wrote:

> Vedran Furač <ved...@vedranf.mine.nu> writes:
>
>> Drazen Kacar wrote:

>>> Tu, prije nego što stisneš enter, zakači strace kao root na su proces, pa


>>> javi rezultate.
>> Nema nekih razlika. Evo bitnijih poziva, ako treba, pasteam sve negdje
>> na web:
>>
>> 27965 geteuid() = 0
>> 27965 geteuid() = 0
>> 27965 getuid() = 1000
>> 27965 geteuid() = 0
>> 27965 getuid() = 1000
>> 27965 geteuid() = 0
>> 27965 setuid(1000) = 0
> ^^^^^^^^^^^^
> Buuuuuuum...

Da. Onda još poslije i pokuša setuid(0), ali to ne ide...

> Trošiš LDAP?

Da.

> Jesi probao za nekog lokalnog korisnika?

Nisam. Nemam takvih (osim sistemskih). Dodao sam jednog i radi što sam i
pretpostavljao.

> Ugl. ak nađeš
> funkciju koja napravi ovaj setuid(2), brijem da ćeš skužit u čemu je
> problem (mislim da nije baš jednostavno kad trošiš pam).

Eh... mislim da ću kontaktirati pam_ldap developere.

auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_ldap.so use_first_pass

account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=1 default=ignore] pam_ldap.so

Nekad sam to sam slagao, a danas, kako vidim, na debianu to održava
pam-auth-update(8) skripta i default se čini OK.

0 new messages