Foydalanuvchilar, huquqlar va xavfsizlik

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

int main(void) {
    uid_t haqiqiy = getuid();
    uid_t amaldagi = geteuid();
    gid_t guruh = getgid();
    gid_t amaldagi_guruh = getegid();

    printf("Haqiqiy UID (real)      : %s\n",
           haqiqiy == 0 ? "0 - root" : "0 emas - oddiy foydalanuvchi");
    printf("Haqiqiy va amaldagi teng? %s\n",
           haqiqiy == amaldagi ? "ha" : "yo'q - setuid dastur");
    printf("Guruh va amaldagi teng?  %s\n",
           guruh == amaldagi_guruh ? "ha" : "yo'q");

    /* Qo'shimcha guruhlar */
    gid_t guruhlar[64];
    int soni = getgroups(64, guruhlar);

    printf("Qo'shimcha guruhlar bormi? %s\n", soni > 0 ? "ha" : "yo'q");

    return 0;
}

id

uid=1000(husanboy) gid=1000(husanboy) groups=1000(husanboy),27(sudo),100(users)

/* getresuid POSIX emas - GNU kengaytmasi */
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>

int main(void) {
    uid_t haqiqiy, amaldagi, saqlangan;

    getresuid(&haqiqiy, &amaldagi, &saqlangan);

    printf("Uchala UID teng bo'lishi kerak (oddiy dastur):\n");
    printf("  Haqiqiy = amaldagi ? %s\n", haqiqiy == amaldagi ? "ha" : "yo'q");
    printf("  Amaldagi = saqlangan ? %s\n",
           amaldagi == saqlangan ? "ha" : "yo'q");

    gid_t hg, ag, sg;
    getresgid(&hg, &ag, &sg);

    printf("\nGuruhlar uchun ham shunday:\n");
    printf("  Uchalasi teng ? %s\n",
           hg == ag && ag == sg ? "ha" : "yo'q");

    return 0;
}

ls -l /usr/bin/passwd /usr/bin/sudo

-rwsr-xr-x 1 root root  68208 may 30  2024 /usr/bin/passwd
-rwsr-xr-x 1 root root 277936 apr  4  2024 /usr/bin/sudo

find /usr/bin -perm -4000 -type f 2>/dev/null | head

/usr/bin/passwd
/usr/bin/sudo
/usr/bin/su
/usr/bin/chsh
/usr/bin/newgrp
/usr/bin/gpasswd

#include <stdio.h>
#include <unistd.h>
#include <errno.h>

int main(void) {
    uid_t boshlangich = geteuid();

    printf("Boshlang'ich amaldagi UID root mi? %s\n",
           boshlangich == 0 ? "ha" : "yo'q");

    /* root emasmiz - root bo'lishga urinish rad etiladi */
    errno = 0;
    int natija = setuid(0);

    if (boshlangich != 0) {
        printf("Root emasmiz, setuid(0) natijasi: %s\n",
               natija == 0 ? "o'tdi" : "rad etildi");
        printf("Bu kutilgan holat - oddiy foydalanuvchi root bo'la olmaydi\n");
    }

    printf("\nTo'g'ri tartib (root uchun):\n");
    printf("  1. setgroups(0, NULL)  - qo'shimcha guruhlarni tashlash\n");
    printf("  2. setgid(yangi_gid)   - avval guruh\n");
    printf("  3. setuid(yangi_uid)   - keyin foydalanuvchi\n");
    printf("  4. Natijani TEKSHIRISH - setuid xato qaytarishi mumkin\n");

    return 0;
}

getcap /usr/bin/ping

/usr/bin/ping cap_net_raw=ep

sudo setcap cap_net_bind_service=+ep /usr/local/bin/mening_serverim

grep Cap /proc/self/status

CapInh:    0000000000000000
CapPrm:    0000000000000000
CapEff:    0000000000000000
CapBnd:    000001ffffffffff
CapAmb:    0000000000000000

capsh --decode=000001ffffffffff | head -3

0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,
cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,
cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,...

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(void) {
    /* Xavfli: PATH ga tayanish */
    setenv("PATH", "/tmp/yolg'on:/usr/bin", 1);

    const char *yol = getenv("PATH");

    printf("PATH qiymati: %s\n", yol);
    printf("Birinchi katalog /tmp da mi? %s\n",
           strncmp(yol, "/tmp", 4) == 0 ? "ha - XAVFLI" : "yo'q");

    printf("\nAgar dastur system(\"ls\") chaqirsa:\n");
    printf("  /tmp/yolg'on/ls topilsa - o'sha bajariladi\n");
    printf("  setuid dasturda bu to'liq root demakdir\n");

    printf("\nYechim: to'liq yo'l ishlatish\n");
    printf("  execv(\"/bin/ls\", argv) - PATH ishlatilmaydi\n");

    return 0;
}

sudo cat /etc/shadow | head -2

root:$6$xyzABC$1kLm...:19845:0:99999:7:::
husanboy:$y$j9T$Qs8p...:19902:0:99999:7:::

ls -l /etc/passwd /etc/shadow

-rw-r--r-- 1 root root  2841 sen  1 09:12 /etc/passwd
-rw-r----- 1 root shadow 1524 sen  1 09:12 /etc/shadow

getenforce

Enforcing

sudo aa-status | head -5

apparmor module is loaded.
42 profiles are loaded.
30 profiles are in enforce mode.
   /usr/bin/man
   /usr/sbin/cupsd

ls -Z /etc/passwd

system_u:object_r:passwd_file_t:s0 /etc/passwd

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(void) {
    /* Xavfsiz vaqtinchalik fayl */
    char shablon[] = "/tmp/xavfsiz_XXXXXX";

    int fd = mkstemp(shablon);

    if (fd < 0) {
        perror("mkstemp");
        return 1;
    }

    printf("Vaqtinchalik fayl yaratildi\n");
    printf("Nomi tasodifiymi? %s\n",
           strcmp(shablon, "/tmp/xavfsiz_XXXXXX") != 0 ? "ha" : "yo'q");

    write(fd, "maxfiy", 6);
    close(fd);

    /* Darhol o'chiramiz - fayl deskriptori orqali ishlash mumkin edi */
    unlink(shablon);

    printf("Fayl o'chirildi   : ha\n");
    printf("\nNima uchun mkstemp:\n");
    printf("  tmpnam/tempnam nomni qaytaradi, faylni yaratmaydi\n");
    printf("  Oradagi vaqtda hujumchi o'sha nomda havola yaratadi\n");
    printf("  mkstemp esa nomni tanlash va yaratishni birga bajaradi\n");

    return 0;
}