I did a program that call setuid(0) and execve(“/bin/bash”,NULL,NULL).
Then I did chown root:root a.out && chmod +s a.out
When I execute ./a.out I get a root shell. However when I do gdb a.out it starts the process as normal user, and launch a user shell.
So… can I debug a suided root program?
Only by running
gdbas root. (In other words, no.)For security reasons, normal users are not allowed to trace processes belonging to other users, especially root.