suid mystery

Dean S. Messing deanm at sharplabs.com
Sat Dec 10 02:53:40 UTC 2011


On Sat  10Dec11 13:08 +1100 Cameron Simpson wrote:
> On 09Dec2011 17:36, Dean S. Messing <deanm at sharplabs.com> wrote:
> | I have a little suid mystery that perhaps someone would
> | kindly help me solve. I just discovered that the files and
> | symlinks in
> |   /usr/lib64/mozilla/plugins-wrapped
> | get their "Modify time" updated each time I start firefox
> | as me (not root).  I just re-started firefox (at 17:19)
> | and here is 'ls -l' of one of the files in the above dir:
> | 
> |   -rwxr-xr-x 1 root avdt 140440 Dec  9 17:19 nswrapper_64_64.libflashplayer.so*
> | 
> | Now, I'm in group "avdt" so it is clearly "me" that
> | updated (or first created) this file. Yet the above
> | directory has these perms and ownership:
> | 
> |     drwxr-xr-x 2 root root
> | 
> | Since neither the directory, nor the files have
> | group write permission, it seems that firefox must be suid
> | root in order to modify these files (if I understand
> | correctly).  But neither the shell script
> | "/usr/bin/firefox", nor the executable that (I think) it
> | calls "/usr/lib64/firefox/firefox" has the SUID bit (nor
> | the SGID bit) set in its perms.
> | 
> | So how can it update these files?  I did not think that firefox could
> | touch any of my "system" stuff.
> 
> It shouldn't be able to, IIUC.

Thanks for the confirmation.

> How are you starting firefox? From the command line by running
> /usr/bin/firefox? Even if not, it would be a useful test. Run that, see
> if the timestamps change.

I normally let KDE start it. When I kill
KDE from "the last time" it was up, so KDE just
restarts it.  Otherise I manually start it from the
firefox icon in the panel.

I just tested your suggestion. The timestamps are changing.

> 
> You can also do this:
> 
>   strace -o str.out -e trace=file -f /usr/bin/firefox
> 
> Invoke firefox that way, watch the timestamps. When they change,
> quit firefox and look at the str.out file to see if firefox is touching
> this stuff.

Will try this and report back later.
Must run now.  Thanks very much for your help!

Dean


More information about the users mailing list