Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible to execute a script if there is no permission to read it? In root mode, I made a script and I want the other user to execute this script but not read it. I did chmod to forbid read and write but allow execute, however in user mode, I saw the message that says: permission denied.

share|improve this question
add comment

6 Answers

up vote 25 down vote accepted

The issue is that the script is not what is running, but the interpreter (bash, perl, python, etc.). And the interpreter needs to read the script. This is different from a "regular" program, like ls, in that the program is loaded directly into the kernel, as the interpreter would. Since the kernel itself is reading program file, it doesn't need to worry about read access. The interpreter needs to read the script file, as a normal file would need to be read.

share|improve this answer
    
Yes but in his case is there a solution? –  Olivier Pons Mar 22 '12 at 10:53
2  
One possibility would be to have a simple C program that embeds the script and calls the interpreter explicitly. A C program does not need to have read permissions to execute. –  Arcege Mar 22 '12 at 12:04
add comment

There's a half truth to the previous statements. You can setup a script so that it's not readable by the user, but still executable. The process is a little drawn out, but it's doable by making an exception in /etc/sudoer so that the user can run the script as yourself temporarily without being prompted for a password. This method: - gets around the setuid patch for other distros. - allows you to give elevated permissions temporarily for a specific script without giving the user sudo rights to everything.

Follow the instruction on this post: File permission execute only

share|improve this answer
add comment

On this situation I used sudo with a NOPASSWD option so the users can run the script without being able to read it.

share|improve this answer
add comment

You can, I think, do this with setuid.

Except that you can't because most distros (apparently) have setuid disabled because it's a massive security hole. It's disabled on mine, so I don't actually know that this answer will work, I'm posting it anyway because I think it should.

Anyway, if I wanted to do what you wanted to do--and I had a distro with setuid enabled for scripts--I would do something like:

$ chmod 700 myscript
$ cat > myscript-nonroot
#!/bin/sh
bash myscript
^D
$ sudo chown root:root myscript-nonroot
$ sudo chmod 4755 myscript-nonroot # make SURE this isn't world-writable!

Which is to say I would write another script whose sole purpose is to call the root-read-only script, change it to be owned by root, and give it the setuid permission. (Along with attendant non-writable status by everyone else.)

Since the myscript-nonroot function is readable by everyone it can be read and executed, and by the time you get two the line where you actually execute your script (bash myscript) it is being run as root (or whoever else you want, the exact user doesn't matter, as long as the wrapper file is owned by the same user.)

share|improve this answer
    
What does 4755 mean? I'm new to this, so I would like to know what it means. I understand the 755 part. Thanks –  Kevdog777 Jul 18 '12 at 8:17
1  
the 4 sets the setuid bit. See the Modes section in the chmod man page on manpagez. –  quodlibetor Jul 18 '12 at 21:16
    
Ok, I still don't quite understand, but it did take me a while to understand the 755 bit. –  Kevdog777 Jul 19 '12 at 7:16
add comment

This is possible only for binaries.

$ chown foo:foo bar
$ chmod 701 bar

As the unprivileged user:

$ ls -lha bar
-rwx-----x 1 foo foo 7.0K 2012-03-15 03:06 bar

$ cat bar
cat: bar: Permission denied

$ ./bar
baz

Now, here is the kicker. While the file is unreadable by conventional means, you can't actually prevent reading the file. This is actually a challenge on http://smashthestack.org/ (level 13). There is a well known utility called hktrace that allows you to read the file using ptrace.

share|improve this answer
    
Very interesting (hktrace). –  fthinker Mar 16 '12 at 5:01
    
is it possible to convert shell script to binary format? –  ashim Apr 4 '12 at 22:57
1  
Actually, you can prevent it, I think. Current linux kernel versions set the process to non-dumpable, meaning no normal user can ptrace it anymore, if the user is not allowed to read the binary. –  thejh May 15 at 11:49
add comment

This is not possible; think about it, when you run the script, the shell needs to read it in order to know what to do.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.