Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to give an ordinary user the ability to fchown() files arbitrarily (as if they were the superuser) on FreeBSD. Generally speaking, is there a right way to change the privilege-checking of a given syscall?

I investigated Capsicum, but for all the articles on the topic, there is a real lack of practical examples out there.

share|improve this question
    
why not use sudo? –  mtm Mar 6 '13 at 9:31
    
@mindthemonkey I don't want to fork an external program; I want to change the rules of the syscall itself. –  ruief Mar 6 '13 at 11:28
    
@ruief: Then I think the answer is clear: edit the source code. –  bahamat Jun 14 '13 at 4:12

1 Answer 1

One solution would be to create your own program that calls fchown(), chown it to root:wheel and set the setuid bit (chmod +s), files run with the setuid bit will be run as the owner the the executable.

Warning You didn't give any specific context, but be aware that allowing a user to run fchown() as root is a foot in the door to gain access to the entire system. For example, one might change the owner of /etc/{passwd,group,shadow}, change the contents, change the owner back, and presto! Instant root.

share|improve this answer
    
I don't want to fork an external program; I want to change the rules of the syscall itself. I am aware of the security implications of doing so. –  ruief Mar 6 '13 at 11:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.