5

I've used bash for years but I 've stuck with the"privileged mode" that it can be configure with the set command.

For example:

set -p

I've read the bash man page but it's somewhat obscure.

For example let's considere the following script

#! /bin/bash -p
ping 192.168.1.1

the permission of this file is as follows:

-rwxr-xr-x. 1 root operador 80 mar 2 23:20 /scripts/privileged.sh

And then as a non-root user I run /scripts/privileged.sh

So I run:

 ps -Cping -ocomm,egroup,euser,ruser,ruser,rgroup
COMMAND         EGROUP   EUSER    RUSER    RUSER    RGROUP
ping            operador operador operador operador operador

OK, you can change the mode, but anyway Linux drops privileges:

[root@server ~]#  chmod 4755 /scripts/privileged.sh 
[root@server ~]# ls -l /scripts/privileged.sh
-rwsr-xr-x. 1 root operador 79 mar  2 23:33 /scripts/privileged.sh

So I run the script as non-root user, and then I get:

[root@server ~]# ps -Cping -ocomm,egroup,euser,ruser,ruser,rgroup
COMMAND         EGROUP   EUSER    RUSER    RUSER    RGROUP
ping            operador operador operador operador operador

So I've found this option useless, please could you correct me, if I misunderstood anything?

7

From the bash info page:

`-p'

      Turn on privileged mode.  In this mode, the `$BASH_ENV' and
      `$ENV' files are not processed, shell functions are not
      inherited from the environment, and the `SHELLOPTS',
      `BASHOPTS', `CDPATH' and `GLOBIGNORE' variables, if they
      appear in the environment, are ignored.  If the shell is
      started with the effective user (group) id not equal to the
      real user (group) id, and the `-p' option is not supplied,
      these actions are taken and the effective user id is set to
      the real user id.  If the `-p' option is supplied at startup,
      the effective user id is not reset.  Turning this option off
      causes the effective user and group ids to be set to the real
      user and group ids.

This says that the -p option lets bash keep the effective userid it is launched with, wheras without it, it will set the effective uid to the actual uid (your user). This will allow the setuid bit to be effective in allowing bash to retain the user it is setuid to. You will note that with the -p option, a host of files and variables are ignored and not inherited from the parent shell.

  • But, I've made some tests and I didn't see any difference, running ps -o comm,euid,ruid -a. I don't understand if that apply to suid shell scripts, and where that option should be used to test the option: the user that runs the shell script? into the shell script header (#!/bin/bash -p), the bash binary with suid (which should be a disaster)... please could you enlightenment? Thanks! – sebelk Feb 25 '14 at 10:59
  • It is way too easy to break into a shell script, so I'd nuke this option for security reasons. Maybe it is (halfways) disabled for OP... – vonbrand Feb 25 '14 at 16:29
  • Sorry, thannks for your efforts for explain. I've read the manpages, as I said, I've made test, I see not any difference at all, I will edit my question... – sebelk Mar 4 '14 at 15:28
-1

Without that you cannot use bash as a SUID binary.

  • anyway in Linux I haven't noted any difference commiting the madness of chmoding even /bin/bash – sebelk Mar 4 '14 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.