Bash -p Flag — Preserve SUID Privileges

When bash is invoked with the -p (privileged) flag, it preserves the effective UID/GID instead of dropping them to the real UID/GID. This is essential when exploiting SUID bash binaries or when a SUID program calls bash without -p. ¹

Default behavior: bash drops privileges

Bash runs with the effective UID of the calling process. However, when bash starts and detects that the real UID ≠ effective UID, it drops privileges by setting the effective UID to the real UID. This is a security feature to prevent accidental privilege escalation through SUID shell scripts.

# Without -p: bash drops euid to ruid
$ ls -l /tmp/bash
-rwsr-xr-x 1 root root 1113504 /tmp/bash
$ /tmp/bash -c 'id'
uid=1000(user) gid=1000(user) groups=1000(user)
 
# With -p: bash preserves euid
$ /tmp/bash -p -c 'id'
uid=1000(user) gid=1000(user) euid=0(root) groups=1000(user)

Exploitation scenarios

SUID bash binary

If bash is installed SUID root (rare but seen in CTFs and misconfigured systems):

bash -p

SUID binary calling bash without -p

When a SUID-root C program calls system("/bin/bash") or execl("/bin/bash", ...) without -p, the resulting shell drops privileges. The fix — from the attacker’s perspective — is to ensure the target program uses -p (see suid-shell-executable for C code that does this correctly).

SUID shell scripts

Linux ignores SUID on shell scripts (the shebang interpreter is invoked with the script path, not SUID). However, on some other UNIX variants, SUID scripts are possible. In those cases, bash -p inside the script preserves privileges.

Detection and hardening

• SUID audit: find / -perm -4000 -type f 2>/dev/null (see find-command) should never list bash or any shell.
• Sudo rules: sudo -l reveals NOPASSWD entries; sudo bash -p is a trivial privesc if allowed.
• Application code: SUID binaries should never call shells. If they must, use absolute paths and sanitize the environment (see unix-permissions).

Sources

• bash(1) — Linux manual page
• bash | GTFOBins

Related: suid-shell-executable, unix-permissions, vim-shell-escape, find-command

Footnotes

1. bash(1) — Linux manual page ↩