bugGNU Screen - Bugs: bug #66522, Reattaching to other user's...

 
 

bug #66522: Reattaching to other user's session results in "seteuid: Operation not permitted" and segfault in 5.0.0

Submitter:  None
Submitted:  Tue 03 Dec 2024 09:11:11 AM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Need Investigation
Privacy:  Public Assigned to:  None
Open/Closed:  Open Release:  5.0.0
Fixed Release:  None Planned Release:  None
Work Required:  None
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Wed 29 Oct 2025 10:03:34 PM UTC, comment #4: 

@anaumov thank you for your reply (previously annonymously)

As you suggested I did the following:
git checkout screen-v5
# now at 1ef836308b8d7c8f0259dc62756b1b19fe82db4b
git revert d10eb5b2f7eebaa347f09c010bd391373fdd1695                    

After building and testing I got:

seteuid: Operation not permitted
[...]
seteuid: Operation not permitted
seteuid: Operation not permitted
Segmentation fault         (core dumped) screen -x user/screenid

Independently of your suggestion, we at Aachner Linux User Group found the following output in strace:

setresuid(1000, 0, 1000)                = 0
setresuid(-1, 1000, -1)                 = 0
setresgid(-1, 0, -1)                    = 0
openat(AT_FDCWD, "/home/hinrikus/.screen", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x560263ddfeb0 /* 3 entries */, 32768) = 96
newfstatat(AT_FDCWD, "/home/hinrikus/.screen/608506.pts-8.redacted", {st_mode=S_IFSOCK|0701, st_size=0, ...}, 0) = 0
socket(AF_UNIX, SOCK_STREAM, 0)         = 4
setresuid(-1, 1000, -1)                 = 0
setresgid(-1, 0, -1)                    = 0
connect(4, {sa_family=AF_UNIX, sun_path="/home/hinrikus/.screen/608506.pts-8.redacted"}, 48) = 0
setresuid(-1, 0, -1)                    = -1 EPERM (Operation not permitted)
setresuid(-1, 0, -1)                    = -1 EPERM (Operation not permitted)

After this we came up with the following fix on
commit: 464c8d8f945f53f8cbb854517279349e09d74756

diff --git a/src/attacher.c b/src/attacher.c
index f2b60f0..fc171b8 100644
--- a/src/attacher.c
+++ b/src/attacher.c
@@ -121,7 +121,7 @@ int Attach(int how)
                real_uid = multi_uid;
                eff_uid = own_uid;
 #ifdef HAVE_SETRESUID
-               if (setresuid(multi_uid, own_uid, multi_uid))
+               if (setresuid(multi_uid, own_uid, eff_uid))
                        Panic(errno, "setresuid");
 #else
                xseteuid(multi_uid);

This worked for me, as we did not drop the saved root uid.

Hinrikus Wolf <hinrikus>
Tue 21 Oct 2025 02:24:44 PM UTC, comment #3: 

I think it can be a duplicate of this:
https://savannah. ... u.org/bugs/?67129

Can you try the git HEAD version without this commit?
https://cgit.git. ... 10bd391373fdd1695

Alexander Naumov <anaumov>
Group administrator
Tue 21 Oct 2025 08:44:13 AM UTC, comment #2: 

Same issue in 5.0.1. It does not crash with segfault and tries it only once. But it is still an issue:
screen -x user/multiuser
seteuid: Operation not permitted

Anonymous
Fri 03 Oct 2025 03:47:51 PM UTC, comment #1: 

Do you get "Multi" in session description by user1?


$ screen -ls
There is a screen on:
        13674.test      (Multi, detached)
1 Socket in /home/alex/.screen.


Can you try to reproduce it in version 5.0.1?

Alexander Naumov <anaumov>
Group administrator
Tue 03 Dec 2024 09:11:11 AM UTC, original submission:  

Screen version: 5.0.0

Tested systems:
Manjaro - 6.10.13-3-MANJARO #1 SMP PREEMPT_DYNAMIC x86_64 (arch packaged version and also compiled manually from tarball)
Lubuntu - 6.8.0-41-generic #41-Ubuntu SMP PREEMPT_DYNAMIC x86_64 (manually compiled)

Trying to reattach to a screen session started by other user results in many "seteuid: Operation not permitted" errors and then segfault. It was working correctly in screen 4.9.1.

I remember one bug related to multiuser sessions that was fixed in 2020 in v4.9.0 (bug #37437) - that may be unrelated to this, but worth checking if that works in v5.0.0. Right now I'm also getting the bug #66142 crash when trying "-X stuff", even on screen compiled from tarball.

Reproduction:

As user1:

screen -S test
^A:multiuser on
^A:acladd user2

As user2:

screen -r user1/test

Effect:

seteuid: Operation not permitted
seteuid: Operation not permitted
seteuid: Operation not permitted
seteuid: Operation not permitted
(...)
seteuid: Operation not permitted
seteuid: Operation not permitted
seteuid: Operation not permitted
seteuid: Operation not permitted
seteuid: Operation not permitted
Segmentation fault (core dumped)


Anonymous

 

Attached Files

This item currently has no attached files.

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by hinrikus (Posted a comment)
  • -email is unavailable- added by anaumov (Posted a comment)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

    History

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2025-10-21 anaumov StatusNone Need Investigation

    Back to the top

    Powered by Savane 3.16-598c.
    Corresponding source code