15

This question already has an answer here:

I want to ensure that my program can only be run by user xyz using root privilege. To do this, I set the setuid bit with:

chmod u+s program1.sh
ls -l program1.sh
rwsr-x--- 1 root house 1299 May 15 23:54 program1.sh

Also, I added user xyz to the house group so that only xyz and root can run program1.sh.

In program1.sh there is

id -u

so that it can show me the effective ID.

Running program1.sh as root, it shows root. But running with the xyz account, it shows xyz. It seems that it didn't run with root privilege. I don't know what's wrong here.

marked as duplicate by Chris Down, Hauke Laging, jasonwryan, Thomas Nyman, Anthon May 19 '14 at 10:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

36

When executing shell scripts that have the setuid bit (e.g., perms of rwsr-xr-x), the scripts run as the user that executes them, not as the user that owns them. This is contrary to how setuid is handled for binaries (e.g., /usr/bin/passwd), which run as the user that owns them, regardless of which user executes them.

Check this page: https://access.redhat.com/site/solutions/124693

This is a security measure taken by operating system. You should use your script with sudo instead.

If you really need to use setuid o your script you can create a binary that will do the work. Create a new file “program.c” and copy the following code:

   #include <stdio.h>
   #include <stdlib.h>
   #include <sys/types.h>
   #include <unistd.h>

   int main()
   {
   setuid(0);
   system("./program.sh");
   return 0;
   }

Compile and execute the code using the following commands:

$ gcc program.c -o program
$ sudo chown root.root program
$ sudo chmod 4755 program
$ ./program

This way it will work.The setuid works for compiled file, and this file can execute others files as root.

Not the answer you're looking for? Browse other questions tagged or ask your own question.