setgid Operation not permitted

Question

I have a C program that calls setgid() with the group id of the group "agrp", and it is saying "Operation not permitted" when I try to run it.

The program has the following ls -la listing:

-r-xr-s--x 1 root      agrp      7508 Nov 18 18:48 setgidprogram

What I want, is setgidprogram to be able to access a file that has the owner otheruser and the group agrp, and permissions set to u+rw,g+rw (User and group read/writeable.)

What am I doing wrong? Does setgidprogram HAVE to have the setuid bit set also? (When I tried it, it worked.)

I am running Fedora 19, and I have SELinux disabled.

EDIT

Here is some example code: wrap.c:

#include <stdio.h>
#include <errno.h>
#include <sys/types.h>
#include <unistd.h>
#include <grp.h>
int main(void)
{
        struct group *grp = getgrnam("agrp");
        printf("%d\n",grp->gr_gid);
        if(setgid(grp->gr_gid) != 0)
        {
                printf("%s.\n", strerror(errno));
                return 1;
        }
        execl("/tmp/whoami_script.sh", NULL);
        printf("%s.\n", strerror(errno));
        return 0;
}

/tmp/whoami_script.sh:

#!/usr/bin/bash
id

$ ls -la /tmp/whoami_script.sh wrap
-r-xr-xr-x 1 root agrp   19 Nov 18 19:53 /tmp/whoami_script.sh
$ ./wrap
1234
uid=1000(auser) gid=1000(auser) groups=1000(auser),0(root),10(wheel)
---x--s--x 1 root agrp 7500 Nov 18 19:55 wrap

Is this enough information now?

I don't think so. Other suid programs are working fine. Plus, this program is sgid not suid. — BenjiWiebe
The update is mildly confusing. It shows a program /tmp/whoami_script.sh that can be run by anyone; a more effective test would give it 550 permissions. However, the output from the code when it is run shows the the SGID-ness of the wrapper program is not taking effect; there is no entry for egid nor any entry for agrp (not even under a different name — don't laugh; I've seen that happen and two entries in /etc/group for GID 1234 with different names both 'work', but ls and id etc only report one of the two names). So, it definitely appears that SGID is not operational for you. — Jonathan Leffler
Note that the mount documentation on Mac OS X says 'nosuid – Do not allow set-user-identifier or set-group-identifier bits to take effect'. It is likely the same on Linux; there is no separate nosgid option. — Jonathan Leffler

BenjiWiebe BenjiWiebe · Accepted Answer · 2013-11-19T03:53:31

This code finally worked:

#include <stdio.h>
#include <errno.h>
#include <sys/types.h>
#include <unistd.h>
#include <grp.h>
int main(void)
{
        gid_t g = getegid();
        if(setregid(g, g) != 0)
        {
                printf("Error setting GID: %s.\n", strerror(errno));
        }
        execl("/tmp/whoami_script.sh", "/tmp/whoami_script.sh", NULL);
        printf("Error: %s.\n", strerror(errno));
        return 0;
}

The problem was I was only setting my effective GID, not my real GID. Therefore, when I exec'd, the child process was started with the EGID set to the RGID. So, in my code, I used setregid which worked fine.

setgid Operation not permitted

2 Answers

Dissecting POSIX