ClearCase on our Days!

Hey,

Let me share this tip:

Imagine that you must  to run an executable with setuid permission  inside a vob, how do you do that?

To be able to do that, basically you will need, as root,  to run "change_suid_mounts -enable" then restart CC, since by default Vobs and Views using "nosuid".

NOTE: Be caution to enable that since  setuid permission over a NO safety code could compromise your system.

See the example below:

1) The code hello.c will print who is the effective user running the command (provided by setuid).

cat hello.c

#include <stdio.h>
main ()
{
 printf (" Details related this process \n" );
 system ( " ps -fe |grep hello |grep -v grep " );
 printf ("\n Type  \"x\" and press \"Enter\" to exit \n");
 scanf ( "%d, &a" );
}

2) I have that file now compiled and belonging  to root

The binary

stat  /home/John/hello
  File: `/home/John/hello'
  Size: 13056      Blocks: 32         IO Block: 4096   arquivo comum
Device: 802h/2050d Inode: 2392121     Links: 1
 

Access: (4755/-rwsr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)

3) Running the code outside ClearCase

John@SUSE1164B:~> whoami
John
John@SUSE1164B:~> ./hello
 Details related this process
root     20982 12727  0 10:31 pts/2    00:00:00 ./hello
 Type  "x" and press "Enter" to exit
x
John@SUSE1164B:~>

So, the code is running as expected and due to setuid it is running as root, even a regular user fire the
binary.

4) Verifying how vob and viewroot ar mounted
 

mount |egrep "John-vob1|viewroot"

SUSE1164B:/dev/mvfs on /view type mvfs (rw,viewroot,nosuid)
xyz-machine:/vol/John/vobs/John-vob1.vbs on /tags/John-vob1 type mvfs (uuid=2d5df461.16d511e1.8eda.00:50:56:98:21:c3,nosuid)

As default both are mounted as "nosuid".

5) If I have the file inside a Vob (and having root as owner) what if the results by running it?

Attempt to run the binary using John (with default options regarding mount)

John@SUSE1164B:~> whoami
John

John@SUSE1164B:~> cleartool setview view1-John-nas

John@SUSE1164B:~> cd /tags/John-vob1/    #Since the vob is already mounted:

John@SUSE1164B:/tags/John-vob1>
> ls -l hello
 

-r-sr-xr-x 1 root John 13056 Jan 11 09:10 hello

John@SUSE1164B:/tags/John-vob1>   ./hello

 Details related this process
John   23772 23717  0 10:56 pts/2    00:00:00 ./hello
 Type  "x" and press "Enter" to exit

Conclusion: Even tough  setuid is set for on "hello" the binary ran as the user that fired the file,
this is expected since vob and /view are mounted with nosuid

6) Enabling setuid on view and mount

Stop the view and then run as root:

change_suid_mounts -enable

Setuid-honoring MVFS mounts are now enabled.  You must stop and
restart ClearCase for this change to take effect.

Then restart clearcase and verify that no is have no more "nosuid" as option:
 

/etc/init.d/clearcase restart
 

mount |egrep "view|John-vob1"

SUSE1164B:/dev/mvfs on /view type mvfs (rw,viewroot)
xyz-machine:/vol/John/vobs/John-vob1.vbs on /tags/John-vob1 type mvfs (uuid=2d5df461.16d511e1.8eda.00:50:56:98:21:c3)

Reference: https://www-304.ibm.com/support/docview.wss?uid=swg21260652

7)   Attempt to run the binary using John (with setuid enabled to mount):

John@SUSE1164B:~> cleartool setview view1-John-nas
John@SUSE1164B:~> cd /tags/John-vob1/
John@SUSE1164B:/tags/John-vob1> ./hello

 Details related this process
root     24927 24914  0 11:05 pts/2    00:00:00 ./hello
 Type  "x" and press "Enter" to exit
x

Conclusion: Having setuid mount enable this setuid work properly.

Regards,

Pedro Moura

##########################################Disclaimer ##############################################
"The postings on this site are my own and don't necessarily represent IBM's positions, strategies or opinions."  #
#################################################################################################