0

If I have a script that does some root actions called /sbin/root_stuff and I wanted user bob to have this script run as his shell when he logs in via SSH, I know I can set his shell to a script that runs sudo /sbin/root_stuff and then edit sudoers to allow this without a password for user bob. Shell scripts don't support SetUID root as far as I know, are there any other supported methods and/or best practices to accomplish this type of thing without using sudo? Linux kernel 2.6 or higher with Bash 4.x.

  • Can you chroot him? – mikeserv Mar 15 '14 at 18:08
  • Alternatively you could mount --bind /dev/null over stuff he shouldn't touch - including mount. – mikeserv Mar 15 '14 at 18:16
  • What kind of stuff? There may be specific solutions for the specific actions. – terdon Mar 15 '14 at 19:11
  • You typically see actual executables that are SUID or Perl scripts. Perl scripts can be made to run SUID. Can you explain what you're actually hoping to run as SUID? That might help us answer your question(s) better. – slm Mar 15 '14 at 21:38
  • 1
    Sudo is the right answer. Why are you looking for something else? – Gilles Mar 15 '14 at 23:45
1

Most Linux distributions disallow scripts (started by #!, shebang) running SUID/SGID (even when the bits are set), as it is much too easy to break into them, or to fool the interpreter to run something else.

  • Where is this functionality implemented? Is it in the Bash interpreter/shell code or a trap of some sort in the fork or exec calls, or something else? – Gregg Leventhal Mar 16 '14 at 15:04
  • 1
    You might find the answer to that question in @Stephane Chazelas's answer here: unix.stackexchange.com/a/119991/52934 – mikeserv Mar 17 '14 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.