Hot answers tagged privileges
70
Security is always about making trade-offs. Root would be most secure if there were no way to access it at all.
I notice that your LD_PRELOAD and PATH attacks assume an attacker with access to your account already, or at least to your dotfiles. Sudo doesn't protect against that very well at all — if they have your password, after all, no need to try ...
23
This is a very complex question. mattdm has already covered many points.
Between su and sudo, when you consider a single user, su is a little more secure in that an attacker who has found your password can't gain root privileges immediately. But all it takes is for the attacker to find a local root hole (relatively uncommon) or install a trojan and wait for ...
12
No, this isn't possible. You can set the immutable attribute with chattr +i, which will at least make it irritating and non-obvious what has to be done to allow writing to the file, but they can just unset it again. Also, your filesystem has to support this, and have the functionality enabled.
SELinux can also do some limiting, but again, it can be ...
8
ping needs root so it can open a socket in raw mode. That's literally the first thing it does when it starts up:
icmp_sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
socket_errno = errno;
That's the only thing it needs root for, so like many programs, it immediately drops its privilege level back to your normal user account:
uid = getuid();
if ...
7
You should read the Arch Wiki page on sudo.
sudo ("substitute user do") allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.
You can install sudo from the repositories and then ...
7
This is from the kill(2) manpage:
For a process to have permission to send a signal it must either be privileged (under Linux: have
the CAP_KILL capability), or the real or effective user ID of the sending process must equal the
real or saved set-user-ID of the target process. In the case of SIGCONT it suffices when the send‐
...
6
setcap 'cap_net_bind_service=+ep' /path/to/program
this will work for specific processes. But to allow a particular user to bind to ports below 1024 you will have to add him to sudoers.
Have a look at this discussion for more.
6
Change the setuid bit of mysqld executable and the ownership of the executable file to mysql account, besides adding the required user in the group mysql for making him have access to the files on the filesystem.
Use visudo -f /etc/sudoers and grant him permission to execute the /etc/rc.d/init.d/mysql start and /etc/rc.d/init.d/mysql stop as two seperate ...
5
The designers of the secured OpenWall GNU/*/Linux distro have also expressed critical opinions on su (for becoming root) and sudo. You might be interested in reading this thread:
...unfortunately both su and sudo are subtly but fundamentally
flawed.
Apart from discussing the flaws of su and other things, Solar Designer also targets one specific reason to ...
5
The simplest way is to use the su(1) command, it has an option that allows you to run a command via the user's shell, example:
su foo -c ls
This will switch to the user foo and run the ls command. If the user you want to use does not have a valid shell (ie it's not in /etc/shells, like /bin/false or /sbin/nologin) you will also have to specify a shell on ...
5
Chroot only restricts filesystem access. If you have root permissions, a chroot is merely an inconvenience, not a secure confinement. Ordinary users can use sockets but not shut down the machine.
There are ways to restrict what users can do: capabilities, AppArmor, SELinux, … But by far the easiest way is to confine the webapp user to a virtual machine. You ...
5
First I'll discuss the setuid bit, which passwd uses and is distinct from the setuid() system call (which passwd does not use). There is perhaps some confusion in the question in this regard.
It is not a protection against a buffer overflow, it's vunerable to such, or basically anything which would allow an attacker to use a privileged process for some ...
4
(Some of these methods have been mentioned in other answers; I'm giving several possible choices in rough order of preference.)
You can redirect the low port to a high port and listen on the high port.
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 1080
You can start your server as root and drop privileges after it's started ...
4
sudo tcpdump -Z uses initgroups(3), setgid(2) and setuid(2) to drop the root privileges of its own process.
# code taken from:
# http://www.opensource.apple.com/source/tcpdump/tcpdump-32/tcpdump/tcpdump.c
/* Drop root privileges and chroot if necessary */
static void
droproot(const char *username, const char *chroot_dir)
{
...
if ...
4
From here (centos.org)
useradd (which is the actual binary the runs when you call adduser, it just behaves differently. See here about that.) has an flag -r which is documented as follows:
-r Create a system account with a UID less than 500 and without a home directory
Which sounds like what you want to do.
4
You mix two different distinctions here:
Between real and effective group ids
Between primary and supplementary users' groups
The first distinction refers to how processes are being run. Normally, when you run a command/program, it is run with the privileges of your user. It has the real group id same as your user's primary group. This can be changed by ...
4
As others have said, generally, the idea of root is a user is permitted to make the machine do anything the machine can do. So, there isn't an easy flag that can prevent root from intentionally deleting a file (chattr +i can prevent accidental deletion).
But, despite this, there are a couple of solutions:
Put the file on a fileserver, and configure the ...
3
su starts a new shell (or runs some other command). It doesn't magically switch the UID of the current shell. If you type exit after entering your password, you'll see that your script continues with the echo statement (but as the original user, not as root).
You can put the part of the script that should be executed as root into a separate script, and ...
3
If I understand correctly, you just need to su from root to some other user. Try copying an su binary (it won't need to be setuid root), but I don't know if that will work on Solaris. Or compile a small C program that drops privileges and executes a command.
Here's a small “down-only” su. Minimally tested. Should compile as is under Solaris and *BSD; you ...
3
In a regular Ubuntu install, you never explicitly set the root user password. You can still however su to root easily by typing sudo su - in a console when logged in as the first regular user you created (which has sudo privileges).
I presume that the password is set to something random and unknown to any human, for security reasons, although this always ...
3
I had similar problems with NetworkManager under AwesomeWM (sic!) (on a Ubuntu 11.10 system).
After fixing other permission related stuff I noticed that NM applet also needs a ConsoleKit session.
To check if this also your problem you can start the NM applet like this:
$ ck-launch-session nm-applet
(for testing purposes you can start it from an xterm)
3
If start-stop-daemon is available on your system you should probably use it and have a look at its options (especially -u and -g in this case).
(Otherwise, you might use a combination of su and sg.)
Update: Here is an example taken from some /etc/init.d/mpd script (which uses start-stop-daemon):
Start command:
echo "Starting Music Player Daemon"
...
3
You seem to be assuming that using sudo always preserves environment variables, but this is not always the case. Here is an excerpt from the sudo manpage:
There are two distinct ways to deal
with environment variables. By
default, the env_reset sudoers option
is enabled. This causes commands to
be executed with a minimal environment
...
2
The short answer is that this is not possible by design.
The long answer is that in the open source worlds there are lots of people playing with the design and coming up with alternate methods. In general it is widely accepted practice that this should not be possible. The fact that you are trying probably means you have another design fault in your system ...
2
If the concern is that a compromised user account can be used to sniff the password used for sudo or su, then use a one-time passcode for sudo and su.
You can force the use of keys for remote users, but that might not pass muster for compliance purposes. It might be more effective to setup an SSH gateway box that requires two-factor auth, then permit key ...
2
The process itself has to call setuid(2). You should also investigate running it inside chroot(8) if you arent already. As far as I know there is no way for root to change the uid of another process.
If the reason you are running it as root is to bind ports I'd suggest running it as a normal user on a higher port and using ipfw(8) on OS X to forward port ...
2
You can run commands as other users using su:
su USERNAME -c COMMAND
Will run COMMAND with privileges dropped to USER.
Note that, by default, su will use the target user's shell interpreter to run the command. By contrast, the default behaviour of sudo is to treat the COMMAND as a standalone program, that is run the current environment. Of course ...
2
The kernel view
Conceptually, there are three sets of groups that a process is a member of. Each set is a subset of the following one.
The single group that is the process's default group, which files created by this process will belong to.
The set of groups that are checked when the group requires permission to open a file.
The set of groups that a ...
2
By default MySQL on Ubuntu and every other distribution has it's own user mysql/mysql. It's normally locked for login.
If you need to have a user with privileges to run stuff as root you will need to add that user to /etc/sudoers file via command visudo. If you need that user to have full root privileges you will need to make that user part of the admin ...
Only top voted, non community-wiki answers of a minimum length are eligible
