Revive an ancient 'su' implementation to explore use with libcap.
That is, this 'su' is not to be installed setuid-root. It is intended
to be installed `setcap =p su`.
With latest PAM sources (ie., newer than Linux-PAM 1.5.1 [*]) and
libcap this is able to validate that ambient capabilities can be applied
by pam_cap.so. For discussion, see this bug:
https://bugzilla.kernel.org/show_bug.cgi?id=212945
Caution. I've done very little auditing of this binary. So, I expect
(and will be happy if folk find them) to hear about bugs etc. What makes
me excited is to explore the ways in which classic "setuid-root" exploit
vectors exhibit with bugs in this code...
[*] At the time of writing Linux-PAM 1.5.1 is the latest release and that
was before the needed pam_unix.so support was committed. See
https://github.com/linux-pam/linux-pam/issues/317#issuecomment-869064103
Signed-off-by: Andrew G. Morgan <[email protected]>
5 files changed
