Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If I have a script that does some root actions called /sbin/root_stuff and I wanted user bob to have this script run as his shell when he logs in via SSH, I know I can set his shell to a script that runs sudo /sbin/root_stuff and then edit sudoers to allow this without a password for user bob. Shell scripts don't support SetUID root as far as I know, are there any other supported methods and/or best practices to accomplish this type of thing without using sudo? Linux kernel 2.6 or higher with Bash 4.x.

share|improve this question
    
Can you chroot him? –  mikeserv Mar 15 at 18:08
    
Alternatively you could mount --bind /dev/null over stuff he shouldn't touch - including mount. –  mikeserv Mar 15 at 18:16
    
What kind of stuff? There may be specific solutions for the specific actions. –  terdon Mar 15 at 19:11
    
You typically see actual executables that are SUID or Perl scripts. Perl scripts can be made to run SUID. Can you explain what you're actually hoping to run as SUID? That might help us answer your question(s) better. –  slm Mar 15 at 21:38
    
As an example: Permissions for a submission script. You can read more about it: perlsec –  slm Mar 15 at 21:40
show 6 more comments

1 Answer 1

up vote 1 down vote accepted

Most Linux distributions disallow scripts (started by #!, shebang) running SUID/SGID (even when the bits are set), as it is much too easy to break into them, or to fool the interpreter to run something else.

share|improve this answer
    
Where is this functionality implemented? Is it in the Bash interpreter/shell code or a trap of some sort in the fork or exec calls, or something else? –  Gregg Leventhal Mar 16 at 15:04
1  
You might find the answer to that question in @Stephane Chazelas's answer here: unix.stackexchange.com/a/119991/52934 –  mikeserv Mar 17 at 6:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.