I've been scared too much by the warning about setuid. However I cannot find a way around using it.

I want to be able to run: arp -s 00:53:00:12:34:56 as the user steven but arp -s requires root.

Would this be the correct way to do it?

sudo nano example.sh
sudo chmod u+s example.sh
sudo chmod og-w example.sh
sudo chmod o+x example.sh

Short story: don't use setuid shell scripts (or any setuid/setgid script).

Long story: Allow setuid on shell scripts

Solution: invoke the command using sudo.

sudo arp -s 00:53:00:12:34:56

To allow the user steven to run this command without entering a password, run visudo and add the following line:

steven ALL = (root) NOPASSWD: arp -s 00\:53\:00\:12\:34\:56

If you have other sudo entries for steven, the NOPASSWD: one(s) need to come last.

  • Could I used nano instead? – Steven Apr 19 '14 at 10:41
  • 1
    @Steven Always use visudo to edit the sudoers file. It verifies the syntax. Despite the name, it doesn't necessarily invoke vi; set the environment variable VISUAL to your favorite editor, e.g. export VISUAL=nano. – Gilles Apr 19 '14 at 10:58
  • I kept getting syntax errors. steven ALL = (root) NOPASSWD: /usr/sbin/arp works however – Steven Apr 19 '14 at 10:59
  • @Steven Ah, my bad, : needs escaping in the command. Edited. – Gilles Apr 19 '14 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.