Re: [linux-lvm] lvcreate from a setuid-root binary

From: Christoph Pleger <christoph.pleger@cs.uni-dortmund.de>
To: LVM general discussion and development <linux-lvm@redhat.com>
Subject: Re: [linux-lvm] lvcreate from a setuid-root binary
Date: Wed, 21 Nov 2018 10:56:58 +0100	[thread overview]
Message-ID: <ae2dff6f425466ed773e8e5330fce33e@cs.uni-dortmund.de> (raw)
In-Reply-To: <1542382913.30686.3@mail.gathman.org>

Hello,

On 2018-11-16 16:41, Stuart D. Gathman wrote:
> It's not very elegant, but the quick and dirty solution is to use sudo

probably you had not yet read that far in this thread, but I already 
wrote that sudo does not work when called from pam_exec.

To get the stderr and stdout results of sudo, I wrote a shell script 
wrapper around it, and the results are (maybe because sudo itself uses 
PAM?):

sudo: unable to change to root gid: Operation not permitted
sudo: unable to initialize policy plugin

Someone wrote that he assumes that pam_exec ignores the setuid-bit in 
the file permissions, but that is obviously wrong, as this whole thread 
is about why lvcreate, when being called from my setuid-root-binary, has 
permission problems though all three (real, effective and saved) UIDs 
are 0 (and of course I checked that they really are 0).

Regards
   Christoph