4

This question already has an answer here:

I have some bash scripts that I use with the user 'root' to manage iptable rules.

The problem is that I want these things at the same time:

  • The script must be owned by root
  • Permissions must be 700
  • I want to have an executable binary that certain user can execute. This executable will run the mentioned script as root.

This used to work, and is still what I use in older distributions:

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

int main()
{
   setuid(0);
   system("/root/iptables/my-iptables-script.sh");

   return 0;
}

So I compile this and then use sudo chown root and sudo chmod 4777. This way the user can now execute the binary and run the script owned by root.

But now I installed Ubuntu 13.10 and when I run that binary I get "permission denied" for the script.

Is it possible that something changed in this respect since 12.04?

What can I do?

marked as duplicate by slm, jasonwryan, vonbrand, Braiam, Anthon Feb 27 '14 at 5:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • can you run the script without the C program? – Braiam Feb 26 '14 at 21:42
  • @Braiam Yes, as root. – ChocoDeveloper Feb 26 '14 at 21:52
  • What happens if you try to run the binary as root? If the error remains then run it as: strace -f -e trace=process /path/to/binary What is the shebang line of the script? – Hauke Laging Feb 26 '14 at 22:11
  • 1
    @ChocoDeveloper Then change the binary to: system("strace -f -o /root/iptables/script.strace /root/iptables/my-iptables-script.sh"); and give us the content of script.strace. – Hauke Laging Feb 26 '14 at 22:35
  • 1
    Is your underlying filesystem mounted nosuid? mount | grep nosuid? – slm Feb 26 '14 at 23:10
5

The easiest and cleanest solution is probably to use sudo.

You can configure it to allow a given unix group to run exactly this script as root.

%iptablegroup ALL = (root) NOPASSWD: /path/to/script 

Then all you have to do is add the needed users to that group and everything should be fine.

  • But I need to run this programatically. I can't use sudo because I won't be there to type in my password. And I don't want to disable the password for sudo. Can I disable it for just this script? – ChocoDeveloper Feb 26 '14 at 23:10
  • Sure you can. I just changed the answer to do so. See man sudoers for lots of examples. – michas Feb 26 '14 at 23:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.