Can a script be executable but not readable?

Question

Is it possible to execute a script if there is no permission to read it? In root mode, I made a script and I want the other user to execute this script but not read it. I did chmod to forbid read and write but allow execute, however in user mode, I saw the message that says: permission denied.

Answer 1

The issue is that the script is not what is running, but the interpreter (bash, perl, python, etc.). And the interpreter needs to read the script. This is different from a "regular" program, like ls, in that the program is loaded directly into the kernel, as the interpreter would. Since the kernel itself is reading program file, it doesn't need to worry about read access. The interpreter needs to read the script file, as a normal file would need to be read.

Answer 2

This is possible only for binaries.

$ chown foo:foo bar
$ chmod 701 bar

As the unprivileged user:

$ ls -lha bar
-rwx-----x 1 foo foo 7.0K 2012-03-15 03:06 bar

$ cat bar
cat: bar: Permission denied

$ ./bar
baz

Now, here is the kicker. While the file is unreadable by conventional means, you can't actually prevent reading the file. This is actually a challenge on http://smashthestack.org/ (level 13). There is a well known utility called hktrace that allows you to read the file using ptrace.

Answer 3

This is not possible; think about it, when you run the script, the shell needs to read it in order to know what to do.

Answer 4

You can, I think, do this with setuid.

Except that you can't because most distros (apparently) have setuid disabled because it's a massive security hole. It's disabled on mine, so I don't actually know that this answer will work, I'm posting it anyway because I think it should.

Anyway, if I wanted to do what you wanted to do--and I had a distro with setuid enabled for scripts--I would do something like:

$ chmod 700 myscript
$ cat > myscript-nonroot
#!/bin/sh
bash myscript
^D
$ sudo chown root:root myscript-nonroot
$ sudo chmod 4755 myscript-nonroot # make SURE this isn't world-writable!

Which is to say I would write another script whose sole purpose is to call the root-read-only script, change it to be owned by root, and give it the setuid permission. (Along with attendant non-writable status by everyone else.)

Since the myscript-nonroot function is readable by everyone it can be read and executed, and by the time you get two the line where you actually execute your script (bash myscript) it is being run as root (or whoever else you want, the exact user doesn't matter, as long as the wrapper file is owned by the same user.)

Answer 5

On this situation I used sudo with a NOPASSWD option so the users can run the script without being able to read it.