setuid example from Wikipedia: 4700

Question

I was reading about setuid on Wikipedia. One of the examples goes as follows:

4700

SUID on an executable file owned by "root"

A user named "tails" attempts to execute the file. The file owner is "root," and the permissions of the owner are executable—so the file is executed as root.

Without SUID the user "tails" would not have been able to execute the file, as no permissions are allowed for group or others on the file. A default use of this can be seen with the /usr/bin/passwd binary file.

I do not understand this. How can user "tails" execute this file at all, since he is not the owner of the file, and group and other permissions are not available?

I tried to recreate this scenario, and indeed:

$ su -c 'install -m 4700 /dev/null suidtest'
$ ls -l suidtest
-rws------ 1 root root 0 21 dec 07:48 suidtest*
$ ./suidtest
bash: ./suidtest: Permission denied

I only got this working with permissions of 4755. Also, the default use mentioned in the example on Wikipedia (the /usr/bin/passwd) has in fact 4755 permissions.

Is the example correct and am I missing something, or is this a mistake?

Answer 1

You are right and the Wikipedia article is wrong. See the below for an example:

$ ls -l /usr/bin/passwd 
-rwsr-xr-x. 1 root root 30768 Feb 22  2012 /usr/bin/passwd
$ sudo cp /usr/bin/passwd /tmp/
$ cd /tmp
$ ls -l passwd
-rwxr-xr-x 1 root root 30768 Dec 21 07:43 passwd
$ sudo chmod 4700 passwd
$ ls -l passwd
-rws------ 1 root root 30768 Dec 21 07:43 passwd
$ ./passwd
bash: ./passwd: Permission denied
$ sudo chmod 4701 passwd
$ ./passwd 
Changing password for user vagrant.
Changing password for vagrant.
(current) UNIX password: 
$