Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think there is a large part of that story missing. If the accounts daemon drops privileges for reading from the user's home, how can it ever get back to its normal state? How could two users run the same operation concurrently?

Normally that privilege dropping should happen after forking, right? And if it does the parent process should respond to gdm's inquiry.

That being said, the initial settings thing is probably good for a few more escalations as its usecase does not seem to fit the standard security measures very well.



From the setresuid(2) man page:

> An unprivileged process may change its real UID, effective UID, and saved set‐user‐ID, each to one of: the current real UID, the current effective UID or the current saved set‐user‐ID.

accountsservice did something like setresuid(uid, uid, -1), which set both real and effective UIDs, but kept saved set‐user‐ID as root, so that it could re-gain root privileges later.

Setting EUID was the correct course of action; but setting real UID let the unprivileged user kill the process.


Would it have been possible to attach a debugger to accountsservice in this state and execute arbitrary code, including re-gaining root privileges?


Very good question. :-) No, you can't use ptrace(2) on a process that has changed its EUID. For details, see PR_SET_DUMPABLE in the prctl(2) man page.


Great. I expected that possibly the real UID controlled this, it's good that it's not the case.


No, you can't usually attach a debugger to a process (with Ubuntu's default settings).


I believe with seteuid the process can temporarily assume the uid of the user in question and later restore the original uid.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: