setuid process cannot see processes owned by that user

Question

I would like to give a non-root user (nicollet) the ability to detect and send a signal to processes started by Apache2 (those processes are FastCGI scripts and the signal tells them to empty their cache). The processes are owned by the web user (www-data), and I'm running on Debian unstable.

I can't find any way to have the nicollet user see those processes.

The processes are running and can see by both root and www-data:

root@linux-01:~# ps -Af | grep baryton
www-data 17649 17648  0 10:27 ?        00:00:00 baryton
www-data 28145     1  0 Nov01 ?        00:00:12 baryton --bot
root     18701 18700  0 10:46 pts/0    00:00:00 grep baryton
root@linux-01:~#

However, running that same command with my nicollet user returns nothing:

nicollet@linux-01:~$ ps -Af | grep baryton
nicollet 18704 18703  0 10:46 pts/0    00:00:00 grep baryton
nicollet@linux-01:~$

I tried creating an executable which runs the above query using system(). It belongs to www-data and has the setuid bit set:

root@linux-01:~# which setuid-update
/usr/local/bin/setuid-update
root@linux-01:~# ls -l /usr/local/bin/setuid-update 
-rwsr-xr-x 1 www-data www-data 11046 Nov  2 10:27 /usr/local/bin/setuid-update
root@linux-01:~#

However, I observe the same situation: the processes are visible by root and www-data but not nicollet:

root@linux-01:~# setuid-update
www-data 17649 17648  0 10:27 ?        00:00:00 baryton
www-data 28145     1  0 Nov01 ?        00:00:13 baryton --bot
www-data 18712 18711  0 10:46 pts/0    00:00:00 sh -c ps -Af | grep baryton
www-data 18714 18712  0 10:46 pts/0    00:00:00 grep baryton
root@linux-01:~# su nicollet
nicollet@linux-01:~$ setuid-update
www-data 18716 18715  0 10:46 pts/0    00:00:00 sh -c ps -Af | grep baryton
www-data 18717 18716  0 10:46 pts/0    00:00:00 grep baryton
nicollet@linux-01:~$

The most surprising is that the grep process is indeed run by www-data (because it's started from a setuid executable) and is visible, but the baryton process isn't.

What's going on here? Why can ps run by www-data show those processes, but ps run by a setuid executable running as www-data cannot, when it's started by nicollet?

Answer 1

For years it's been possible to restrict at kernel-level the regular user accounts to see only their own processes. This restriction has been possible with grsecurity, SELinux and other security frameworks, but not commonly used by default by the distributions.

I haven't tried Debian unstable branch for a while (been running Lenny), but perhaps they have lately toggled on that switch on the kernel configuration. It would cause exactly the same effect you are observing -- even with setuid executable the original uid (nicollet) is still known and only EUID (effective uid) gets changed.