I encapsulated a cat / etc/shadow command in C language, set the suid bit of the program and set its owner to root,. Why can"t you access / etc/shadow? when executed as an ordinary user? Is it possible that exec doesn"t inherit the suid property when it executes a new program?
// encapsulation.c
-sharpinclude <stdio.h>
-sharpinclude <stdlib.h>
-sharpinclude <unistd.h>
-sharpinclude <sys/types.h>
int main(){
printf("uid is %d\n", getuid());
printf("euid is %d\n", geteuid());
execlp("/bin/sh", "sh", "-c","echo $UID $EUID;/bin/cat /etc/shadow", (char*)NULL);
return 0;
}
test gcc encapsulation.c -o encapsulation
test ./encapsulation
uid is 1000
euid is 1000
/bin/cat: /etc/shadow: Permission denied
test sudo chown root:root encapsulation
[sudo] password for inovker:
test ./encapsulation
uid is 1000
euid is 1000
/bin/cat: /etc/shadow: Permission denied
test sudo chmod u+s encapsulation
test ./encapsulation
uid is 1000
euid is 0
/bin/cat: /etc/shadow: Permission denied
test sudo ./encapsulation
uid is 0
euid is 0
root:!:17655:0:99999:7:::
daemon:*:17647:0:99999:7:::
bin:*:17647:0:99999:7:::
sys:*:17647:0:99999:7:::
sync:*:17647:0:99999:7:::
games:*:17647:0:99999:7:::
man:*:17647:0:99999:7:::
...