Second setuid not permitted - c++

Question

If I call setuid in a loop to become root and reset the uid, this works only once.
I have the following code:
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
int my_func(int i) {
int current_uid = getuid();
int ret;
fprintf(stderr,
"### i=%d ###: My UID is: %d. My GID is: %d, before 'system(id)'\n",
i, current_uid, getgid());
system("/usr/bin/id");
fprintf(stderr,"\n\n### i=%d ###: before 'setuid(0)'\n", i);
if (setuid(0)) {
perror("setuid");
return 1;
}
fprintf(stderr,"after 'setuid(0)'\n\n");
//I am now root!
fprintf(stderr,
"### i=%d ###: I an now root: My UID is: %d. My GID is: %d, before 'system(id)'\n",
i, getuid(), getgid());
system("/usr/bin/id");
//Time to drop back to regular user priviledges
fprintf(stderr,"\n\nbefore 'setuid(%d)'\n",current_uid);
ret=setuid(current_uid);
fprintf(stderr,
"### i=%d ###: My UID is: %d. My GID is: %d, before 'system(id)\n",
i, getuid(), getgid());
system("/usr/bin/id");
}
int main(void) {
int i;
for (i=0;i<3;i++) {
my_func(i);
sleep(5);
fprintf(stderr,"\n\n");
}
return 0;
}
I set the SUID bit and run this program as ordinary user rose. The output is:
rose#condor:/home/rose/Txt/src/Test/C/Setuid(5)$ ll /usr/local/bin/multiple_setuid_test
-rws--x--x 1 root root 13589 11. Dez 08:41 /usr/local/bin/multiple_setuid_test*
rose#condor:/home/rose/Txt/src/Test/C/Setuid(6)$ /usr/local/bin/multiple_setuid_test
i=0 ###: My UID is: 1203. My GID is: 100, before 'system(id)'
uid=1203(rose) gid=100(users) Gruppen=100(users),4(adm),6(disk),7(lp),10(wheel),14(uucp),18(audio),19(cdrom),27(video),35(games),60(mysql),250(portage),1001(haldaemon),1002(plugdev),1008(scanner),1027(vboxusers),1028(kvm),1029(qemu),1036(gsm),1039(pulse-access),1040(pulse),1041(tuntap)
i=0 ###: before 'setuid(0)'
after 'setuid(0)'
i=0 ###: I an now root: My UID is: 0. My GID is: 100, before 'system(id)'
uid=0(root) gid=100(users) Gruppen=0(root),4(adm),6(disk),7(lp),10(wheel),14(uucp),18(audio),19(cdrom),27(video),35(games),60(mysql),100(users),250(portage),1001(haldaemon),1002(plugdev),1008(scanner),1027(vboxusers),1028(kvm),1029(qemu),1036(gsm),1039(pulse-access),1040(pulse),1041(tuntap)
before 'setuid(1203)'
i=0 ###: My UID is: 1203. My GID is: 100, before 'system(id)
uid=1203(rose) gid=100(users) Gruppen=100(users),4(adm),6(disk),7(lp),10(wheel),14(uucp),18(audio),19(cdrom),27(video),35(games),60(mysql),250(portage),1001(haldaemon),1002(plugdev),1008(scanner),1027(vboxusers),1028(kvm),1029(qemu),1036(gsm),1039(pulse-access),1040(pulse),1041(tuntap)
i=1 ###: My UID is: 1203. My GID is: 100, before 'system(id)'
uid=1203(rose) gid=100(users) Gruppen=100(users),4(adm),6(disk),7(lp),10(wheel),14(uucp),18(audio),19(cdrom),27(video),35(games),60(mysql),250(portage),1001(haldaemon),1002(plugdev),1008(scanner),1027(vboxusers),1028(kvm),1029(qemu),1036(gsm),1039(pulse-access),1040(pulse),1041(tuntap)
i=1 ###: before 'setuid(0)'
setuid: Operation not permitted
i=2 ###: My UID is: 1203. My GID is: 100, before 'system(id)'
uid=1203(rose) gid=100(users) Gruppen=100(users),4(adm),6(disk),7(lp),10(wheel),14(uucp),18(audio),19(cdrom),27(video),35(games),60(mysql),250(portage),1001(haldaemon),1002(plugdev),1008(scanner),1027(vboxusers),1028(kvm),1029(qemu),1036(gsm),1039(pulse-access),1040(pulse),1041(tuntap)
i=2 ###: before 'setuid(0)'
setuid: Operation not permitted
rose#condor:/home/rose/Txt/src/Test/C/Setuid(7)$ uname -a
Linux condor 3.12.4 #1 SMP Mon Dec 9 11:37:38 CET 2013 x86_64 Intel(R) Core(TM)2 CPU 6600 # 2.40GHz GenuineIntel GNU/Linux
Any hint is appreciated.

Answer 1

Linux (just like other unixes) store two values: your real user id, which is set by setuid, corresponds to your login, and is not changed by the s-bit, and your effective user id, which is set by seteuid, and gets changed when you execute a program that has the s-bit set. To be allowed to use setuid(), either your real or your effective user id need to be zero, but if you use setuid() to drop privileges (change from 0 to anything else), your effective user id will be changed as well. So your first setuid(1203) sets the effective user id to 1203 as well, which prevents you from regaining privileges later.
To change from and to root several times, you have to use the setreuid() call to swap both - setreuid(1203, 0) would change your real user id to 1203, and the effective user id to 0, thus allowing you to set the uid to 0 later.
Note that, as long as either of the two uids is 0, you have root privileges. With uid=1203 and euid=0, files you create will belong to you (user id 1203), but you'll still have root access. So check your program for security implications very carefully.
If you need to have root access every now and then throughout your program, it's much safer to create a pipe(), fork() off a child process that keeps root privileges, drop privileges in the parent process, and send some command down the pipe for the child to execute when you need something done as root. That way, you have to security audit only the child process, which is presumably much smaller than your whole program.

Answer 2

Once you give up root privileges by using setuid to change to a non-root user, you no longer have the privileges necessary to use setuid to become root once again.