Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have some program called foo that needs root privileges when it executes. foo needs to be able to be run by any user and can be located at any path. The reason this program can be at any path is because our company is developing program foo and each user may have a personal version of the program in some personal directory while they work on it.

My question is this, what is the most secure way to handle this? I have been researching the sudoers file and have basically 2 ideas.

  1. List all paths the program can be at in the sudoers file. This is problematic because it requires frequent editing of the sudoers list and also still poses a security risk since non root users will own their individual copy of foo and could copy some system program over foo and then use it as root.

  2. Write a script called start_foo which performs some input validation on the passed program such as size and name and then starts the passed in foo. start_foo could live in /usr/bin and owned by root but runnable by anyone. This option still includes the security hole of being able to write over the users foo program with another root requiring program but hopefully the size check would catch some malicious cases.

Is there a "cannonical" way to solve this problem I haven't found or thought of? If not which of the above or possibly other solution is the best way to handle the problem?

share|improve this question
1  
Give each user a virtual environment where they can run as root without causing any damage? –  grebneke Mar 3 at 21:44
1  
Unfortunately what you are trying to do is insecure by definition, allowing a program that is not own by root to execute with root privileges is always going to leave things wide open. For approach 2 you would need to use a wrapper program (a script won't work‌​), that uses setuid, simply have the program owned by root is not enough. Also, would the size not change when the developers compile different versions of the program? I don't see this working as a security measure. –  Graeme Mar 3 at 21:45
    
A setuid wrapper script could, in theory, maintain a list of md5sums of valid builds and compare against that. But as Graeme wrote, the approach is insecure by definition. Go for sandboxed virtual environments. –  grebneke Mar 3 at 22:39
4  
Your company needs to develop programs that don't require root privileges everywhere for everyone. Seriously. –  mikeserv Mar 4 at 4:58
2  
Users have no business running stuff they own as root, period. Fix the permissions of whatever foo is frobbing (via ACLs, SELinux, ...). –  vonbrand Mar 5 at 17:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.