c - 为什么在使用 system() 调用管理程序的 setuid-root C 程序中需要 setuid(0)？

Question

我不得不为某人做一个肮脏的 Linux hack，这样他们就可以在非根用户的情况下使用 cupsenable printername shell 命令启动打印机。我不希望他们能够以 root 身份使用整个 cupsenable 语法，所以我只是编写了一个 C 包装器来清理 argv[1] 中的输入并调用 system("cupsenable sanitizedprintername")。

我将程序设为 root，但即便如此，cupsenable 仍因“权限被拒绝”而失败。然后我在 system() 之前插入了一个 setuid(0) 调用，你瞧，它成功了。

忽略有更好的方法让用户控制打印机的问题。可能有更好的方法。我感兴趣的是 chmod u+s 与 setuid(0) 与 system() 的复杂性。为什么会这样？

Answer 1

来自 man 系统:

Do not use system() from a program with set-user-ID or set-group-ID privileges, because strange values for some environment variables might be used to subvert system integrity. Use the exec(3) family of functions instead, but not execlp(3) or execvp(3). system() will not, in fact, work properly from programs with set-user-ID or set-group-ID privileges on systems on which /bin/sh is bash version 2, since bash 2 drops privileges on startup.

来自man bash:

If the shell is started with the effective user (group) id not equal to the real user (group) id, and the -p option is not supplied, no startup files are read, shell functions are not inherited from the environment, the SHELLOPTS variable, if it appears in the environment, is ignored, and the effective user id is set to the real user id.

看来您的 setuid(0) 调用绕过了该保护。