Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I invoke cp -a 1 2 from a non-root user, the ownership is being preserved, despite the fact that file 1 belongs to another user. My understanding was this shouldn't be possible.

What is going on?

share|improve this question

1 Answer 1

Make sure the cp binary doesn't have the setuid bit set...

$ ls -l /bin/cp /tmp/badcp1
-rwxr-xr-x 1 root root 103K Jul  1 11:59 /bin/cp
-rwsr-xr-x 1 root root 103K Jul  1 11:59 /tmp/badcp1
   ^

...and that it doesn't have any special capabilities assigned:

$ getcap /tmp/badcp2 
/tmp/badcp2 = cap_chown,cap_fowner+eip

If either is true, this question is a good start.

share|improve this answer
    
No to both cases. –  Matt Joiner Jul 4 '11 at 2:35
    
Interesting. Can you successfully run chown (either the command or the programming function) on a file in the target filesystem? What type is the target filesystem? Are you sure that your uid is not 0? –  grawity Jul 4 '11 at 9:34
    
@Matt: also, even if you don't have getcap, the OS feature is still there. An attacker may have brought their own copy of libcap2-bin. A good test is cat /bin/cp > /tmp/cp; chmod +x /tmp/cp, then try to use the /tmp/cp -a command to copy files and see if the strange behavior persists. –  grawity Jul 4 '11 at 10:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.