Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I invoke cp -a 1 2 from a non-root user, the ownership is being preserved, despite the fact that file 1 belongs to another user. My understanding was this shouldn't be possible.

What is going on?

share|improve this question

Make sure the cp binary doesn't have the setuid bit set...

$ ls -l /bin/cp /tmp/badcp1
-rwxr-xr-x 1 root root 103K Jul  1 11:59 /bin/cp
-rwsr-xr-x 1 root root 103K Jul  1 11:59 /tmp/badcp1
   ^

...and that it doesn't have any special capabilities assigned:

$ getcap /tmp/badcp2 
/tmp/badcp2 = cap_chown,cap_fowner+eip

If either is true, this question is a good start.

share|improve this answer
    
No to both cases. – Matt Joiner Jul 4 '11 at 2:35
    
Interesting. Can you successfully run chown (either the command or the programming function) on a file in the target filesystem? What type is the target filesystem? Are you sure that your uid is not 0? – grawity Jul 4 '11 at 9:34
    
@Matt: also, even if you don't have getcap, the OS feature is still there. An attacker may have brought their own copy of libcap2-bin. A good test is cat /bin/cp > /tmp/cp; chmod +x /tmp/cp, then try to use the /tmp/cp -a command to copy files and see if the strange behavior persists. – grawity Jul 4 '11 at 10:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .