I would like that my Unix users can only run a specific command insecurecommand with a controlled list of arguments stored in a file.

The only solution I have found at this time is to :

  1. Create a new security group called cmdxg
  2. Limit the execution of the command to this group:

    chown root:cmdxg /.../insecurecommand
    chmod 750 /.../insecurecommand
  3. Create a setgid wrapper, which executes the command:

    ls -al /.../mywrapper
    -rwxr-sr-x 1 root cmdxg /.../mywrapper

The only problem is that insecurecommand is executed with gid=cmdxd and not with the users real gid. However, I'd like to avoid running the insecurecommand command setgid.

If in the wrapper code, I go back to real gid with seteuid(), it can't run the insecurecommand anymore because the process lost the cmdxg right.

Is it a way to run a command that needs privileged gid rights, but with the real gid ?

Maybe I need to decompose the program execution ?

-> first load the binary with the privileged effective gid -> go back to the real gid -> run the program

But how can I do this ?

Any ideas ?

  • I don't follow "If in the wrapper, I go back to real gid I can't run the command anymore." Jun 29 '14 at 8:09
  • 3
    Could you not just use sudo?
    – Warwick
    Jun 29 '14 at 8:10
  • @Warwick good point. if the poster is ok having the list of arguments in /etc/sudoers or similar. Jun 29 '14 at 8:37
  • Thank you for the sudo suggestion but I don't understand how to implement it. Sudo permit to execute a command as another user. As the insecurecommand can't be executed unprivileged, I need a special user for the insecurecommand sudo execution. But in this case the uid and gid are not set accordingly to the original user executing the command and this is problematic for the file created by the insecurecommand program.
    – Prunkdump
    Jun 29 '14 at 9:05
  • i would recommend you to write a wrapper script which does filter the arguments allowd and then invoke the command it selfs. then just call the script like the actual command and add the path to it to the $PATH variable but make shure to place it before the path of the actual commands path.
    – konqui
    Jun 29 '14 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.