one more time...

[Ken Arromdee]

I posted this before to some other groups.  I didn't get many responses, but
some of the ones I did get suggested this was a bug.  So...
--------------------------------------------------
% uids
Real: user 7943 (ins_akaa), group 2048
Effective: user 7943 (ins_akaa), group 2048
% cd /s/adev/src/h/src
% cat test.c
extern unsigned short getuid();
extern unsigned short geteuid();

main()
{
        printf("Before setuid(getuid())\n");
        printf("Real UID=%d; effective UID=%d\n",
                (int)getuid(), (int)geteuid());
        setuid(getuid());
        printf("After setuid(getuid())\n");
        printf("Real UID=%d; effective UID=%d\n",
                (int)getuid(), (int)geteuid());
        execl("/bin/sh", "sh", 0);
}
% ls -l a.out
-rwsr-xr-x   1 adev     210        19905 Apr 10 23:10 a.out*
% a.out
Before setuid(getuid())
Real UID=7943; effective UID=210
After setuid(getuid())
Real UID=7943; effective UID=7943
% uids
Real: user 7943 (ins_akaa), group 2048
Effective: user 210 (adev), group 2048
% % 
-----------------------------------------------------------
This was run on a 3B4000 running Sys V 3.1.5.  The problem is that within
a setuid program, the call setuid(getuid()) seems to work properly to
set the effective UID back to the real one.  However, upon exec'ing a
shell, the effective uid is suddenly that of the program's owner again, and
is no longer equal to the real one.
--
"But then, two Dr. McCoy's just might bring the level of medical efficiency on
this ship up to acceptable levels."

Kenneth Arromdee (UUCP: ....!jhunix!ins_akaa; BITNET: g49i0188 at jhuvm;
     INTERNET: arromdee at crabcake.cs.jhu.edu) (please, no mail to arrom at aplcen)