Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have a script that does some root actions called /sbin/root_stuff and I wanted user bob to have this script run as his shell when he logs in via SSH, I know I can set his shell to a script that runs sudo /sbin/root_stuff and then edit sudoers to allow this without a password for user bob. Shell scripts don't support SetUID root as far as I know, are there any other supported methods and/or best practices to accomplish this type of thing without using sudo? Linux kernel 2.6 or higher with Bash 4.x.

share|improve this question
Can you chroot him? – mikeserv Mar 15 '14 at 18:08
Alternatively you could mount --bind /dev/null over stuff he shouldn't touch - including mount. – mikeserv Mar 15 '14 at 18:16
What kind of stuff? There may be specific solutions for the specific actions. – terdon Mar 15 '14 at 19:11
You typically see actual executables that are SUID or Perl scripts. Perl scripts can be made to run SUID. Can you explain what you're actually hoping to run as SUID? That might help us answer your question(s) better. – slm Mar 15 '14 at 21:38
As an example: Permissions for a submission script. You can read more about it: perlsec – slm Mar 15 '14 at 21:40
up vote 1 down vote accepted

Most Linux distributions disallow scripts (started by #!, shebang) running SUID/SGID (even when the bits are set), as it is much too easy to break into them, or to fool the interpreter to run something else.

share|improve this answer
Where is this functionality implemented? Is it in the Bash interpreter/shell code or a trap of some sort in the fork or exec calls, or something else? – Gregg Leventhal Mar 16 '14 at 15:04
You might find the answer to that question in @Stephane Chazelas's answer here: unix.stackexchange.com/a/119991/52934 – mikeserv Mar 17 '14 at 6:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.