Messages in this thread | | | Date | Tue, 12 May 2020 02:45:24 -0700 | From | Vito Caputo <> | Subject | Question regarding blocking set[ug]id on processes including via suid executables |
| |
Hello folks,
I'm curious if someone knows a way to do this using existing linux interfaces.
I'd like to create a login lacking the ability to switch uid/gid.
Even if the process has access to suid executables like /bin/su, and the user has the root password, I'd like the descendant processes of their login to be simply incapable of changing uid/gid, even when it's in the form of running a program w/suid bit set on an existing and accessible executable in the filesystem. No matter what, it just can't happen.
Do we have any such thing today? I'd really like to be able to set this on a specific user and all logins of that user are simply stuck on that uid no matter what.
Thanks in advance, Vito Caputo
| |