Hands-On System Programming with Linux

Hacking attempt 2

Ah, hacking! Well, let's at least attempt to.

We know that EUID 0 is a special value—it means we have root privilege. Think about it—we have a setuid(2) system call. So, even if we're unprivileged, why not just do a quick

setuid(0); become privileged, and hack away as root!

Hmm, Linux wouldn't be a very powerful and popular OS if the above hack were to actually work. It won't work, folks: the above system call invocation would fail returning -1; errno would be set to EPERM and the error message (from perror(3) or strerror(3)) would be this: Operation not permitted.

Why is this? There's a simple rule within the kernel: an unprivileged process can set its effective IDs to its real IDs—no other value is allowed. In other words, ...