I was reading about setuid on Wikipedia. One of the examples goes as follows:
4700
SUID on an executable file owned by "root"
A user named "tails" attempts to execute the file. The file owner is "root," and the permissions of the owner are executable—so the file is executed as root.
Without SUID the user "tails" would not have been able to execute the file, as no permissions are allowed for group or others on the file. A default use of this can be seen with the
/usr/bin/passwd
binary file.
I do not understand this. How can user "tails" execute this file at all, since he is not the owner of the file, and group and other permissions are not available?
I tried to recreate this scenario, and indeed:
$ su -c 'install -m 4700 /dev/null suidtest'
$ ls -l suidtest
-rws------ 1 root root 0 21 dec 07:48 suidtest*
$ ./suidtest
bash: ./suidtest: Permission denied
I only got this working with permissions of 4755
. Also, the default use mentioned in the example on Wikipedia (the /usr/bin/passwd
) has in fact 4755
permissions.
Is the example correct and am I missing something, or is this a mistake?