Search code examples
linuxsecurityprocessprivilegesmultiple-users

Is it possible for a process in Linux to change another process's UID?


I was wondering if it was possible for a process in Linux (assuming it had root access) to change another process's UID including the RUID, SUID, and EUID, and if so, if there was a specific implementation I could do (whether that be in C++ or in a bash script, e.t.c). I'm mainly trying to stop certain recurrent processes from executing with root privileges immediately upon spawn, which they seem to upon spawning.

Thanks! My apologies if the question is unclear. If it is, I can clarify any details.


Solution

  • No, it is not possible for one process to change another process's UID. That would be a huge security problem if so. If you're in process A, you don't know what state process B is in, and you don't know if elevating privileges is safe at that point. Similarly, you could cause a privileged process to hog shared resources and deadlock other processes if you forced it to drop privileges unexpectedly, since it might fail in the middle of a critical section.

    Even if you could somehow work around this, you'll still run into a race condition that your spawned process could execute any amount of code (how much, you don't know) as root before you can force it to drop privileges.

    You should figure out what's spawning your processes and adjust it to either not spawn them as root or prevent it from spawning them at all.