Not setuid, still root
Auditing which programs can run as root usually means searching for the setuid bit, and on a clean Debian install that list is short and stable. It is also incomplete. Linux capabilities split root's power into individual pieces that can be attached to a binary directly, with no setuid bit involved - so a file with ordinary rwxr-xr-x permissions, invisible to a setuid search, can still hold cap_setuid and change its user id. Compare the permissions against a genuine setuid program such as passwd, which shows an s where the execute flag would be, then list file capabilities separately. On most machines the capability list is empty, which is what makes any entry in it worth reading carefully.
This program is not setuid, and it can still become root.
You audited the programs that run as root, the list came back short and familiar, and nothing looked out of place. That audit has a blind spot.
Here is an ordinary looking binary. Its permissions are the same as any file you own, with no special bit set.
Compare it against a real one. That program carries an s where the execute flag would be, and that is what a setuid search looks for.
Search this directory for that bit and you get nothing back. But there is a second mechanism. Ask for file capabilities instead, and the same binary comes back holding the one that lets a process change its user id.
That is the whole point. A capability grants a single power without the bit everyone searches for, so a setuid audit on its own will never show it.
Check both lists. The second one is usually empty.
#linux#security#selfhosted#infosec#sysadmin
❯ Check both lists. The second one is usually empty.