What is the policy for permissions on /proc/<pid>/environ? </pid>

1353
midenok

I see, that usual user process gets user-readable permissions:

-r-------- 1 1000 1000 0 Nov 19 13:51 /proc/9083/environ 

but f.ex. SCREEN daemon gets root ownership:

-r-------- 1 root root 0 Nov 19 13:47 /proc/9167/environ 

Though, 9167 is also user UID:

# ps axnu|grep 9167 1000 9167 0.0 0.0 23488 2008 ? Ss 13:47 0:00 SCREEN 
2

1 ответ на вопрос

2
grawity

On most systems, /usr/bin/screen is installed with the setuid bit for root, meaning it will first start with effective UID 0, and only later drop privileges (returning to your normal UID).

(This is used for implementing the "session sharing" feature, as your Screen wouldn't be allowed to connect to other users' Screen sockets otherwise.)

But, since privileged processes could potentially keep sensitive information in memory, the kernel gives them special protection – even if they drop all privileges and switch to your UID, you still cannot send them signals, attach a debugger, or create core dumps.

The "no core dumps" option, also known as the fs.suid_dumpable sysctl setting, is what causes Screen's /proc files to be permanently owned by root regardless of its effective UID.

Похожие вопросы