Re: setuid and generate-application

Jack Tanner <[email protected]> wrote:

>> I've used generate-application to build a deliverable. I'd like to
>> make it run with the setuid bit set. (Using ACL 6.2 on Fedora Core 2.)
>> 
>> # whoami
>> luser
>> # ls -alF
>> drwxrwxr-x   2 luser luser     4096 Jan 11 19:41 ./
>> drwx------  14 luser luser     4096 Jan 11 19:43 ../
>> -rw-r--r--   1 luser luser 12277022 Oct 22 02:14 files.bu
>> -rwxr-xr-x   1 luser luser   545830 Apr 19  2004 libacli623.so*
>> -rw-rw-r--   1 luser luser    89264 Jan 11 19:41 make.stdout
>> -rwsr-sr--   1 luser luser    34040 Jan 11 19:40 myapp*
>> -rw-rw-r--   1 luser luser 18710528 Jan 11 19:41 myapp.dxl
>> -rw-rw-r--   1 luser luser     1166 Jan 11 19:40 myapp.lic
>> # ./myapp
>> [Runs great]
>> # su luser2
>> Password:
>> # ./myapp
>> couldn't open process map file
>> Unable to locate enough free space to restore C heap
>> Could not restore the image file:
>>      /home/luser/myapp/myapp.dxl.

It would be interesting to see an strace of the above.

>> I can make do with
>> # su luser2 -c ./myapp
>> 
>> but then luser2 can't have a shell of /sbin/nologin. Is there any
>> reason setuid doesn't work?

I thought the "se luser2" would require a login shell and not the "su
luser2 -c ./myapp" form.

-- 
Kevin Layer             [email protected]        http://www.franz.com/
Franz Inc., 555 12th St., Suite 1450, Oakland, CA  94607, USA
Phone: (510) 452-2000   FAX: (510) 452-0182