Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Trying to understand why ssh-agent has sgid bit and found this post ssh-agent has sgid

I have another question, why the group ownership of ssh-agent is nobody not root? What is the reason behind it? Will it still work if group ownership is root?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

If it were setgid root then the agent would run as group root, which likely has broader permissions than the user it started as. That could be a security risk; at the least, running something as root unnecessarily is a red flag (even the group) and requires extra attentiveness.

Setting the group ownership to nobody, which is a group that shouldn't have any meaningful permissions or files attached, means that ssh-agent doesn't get any more rights than the user started with. As the linked question says, the reason it's setgid in the first place is to prevent ptracing the program, rather than because it actually needs different permissions. In the discussion thread linked from the other question, one of the developers notes:

it would seem that the group is of no consequence. It's the fact that the binary is setgid anygroup that's important.

nobody is a handy group to use when you only want a side effect of setgid, not the behaviour itself.

I imagine it would still work with setgid root. I just tried that here, and it didn't complain at all and seemed to work in cursory testing. That said, I can't think of any actual reason to change it to that - everyone seems to be better off with it running as group nobody than group root.

I don't suggest changing the permissions of files installed by your package manager, in any case, because they tend to get upset about any modifications to the files they control.

share|improve this answer
    
+1. More programs setuid/setgid root means more entry points on the machine (and everything connected to it) (Each bug, weak security, etc in the program's code could maybe be exploited to create/run things as root. Whereas setuid/setgid nobody wouldn't give exploits much access, other than basic unpriviledged commands use and file creation). –  Olivier Dulac Jul 8 at 8:04

The point of making ssh-agent setgid is to increase security by making the process impossible to debug, so that even a process running as the same user can't dump keys from memory.

ssh-agent should not in fact have additional privileges. In case there is a vulnerability in ssh-agent, if it is setgid to some group, this confers the user the privileges of that group. Running ssh-agent setgid therefore increases the security risk… unless the group that ssh-agent runs as has in fact no privileges whatsoever — in particular, no write permission on any file.

The best way to run a program setgid without having an impact on other programs is to use a dedicated group. That's what Debian does, for example: ssh-agent runs as the group ssh. Fedora uses the group nobody, which is dodgier but still ok as no file should ever be owned by the group nobody. The group root would be a bad idea because it owns a lot of files.

share|improve this answer
    
+1(00) for those important additionnal infos! (for why setgid prevents same user to debug: Gilles himself comes up in a google search : unix.stackexchange.com/a/15912/27616 ) –  Olivier Dulac Jul 8 at 8:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.