I have heard that it is good practice to run an executable as a user with a completely different privilege set than the owner of the task. In fact I heard that it is best to run it as a different user with exactly the opposite privilege set. I can understand limiting the privileges of a run time user, but can't this be achieved by the setuid feature?
-
Please be more specific and if possible give a concrete example. What is the "owner of the task"? Where is the difference to the user running the executable? Where did you "hear" one should do this?– fschmittOct 6, 2010 at 19:00
-
I was discussing with a colleague how he managed to run an executable that was supposed to delete log files and by mistake wiped out a bin directory which had all application executables. He mentioned that he this could have been prevented if a different owner owned all the executables and we ran them as a different user. so /apps/bin/executable will be owned by local_admin user but it will only ever be run by normal_user who does not own any executables and does not have write privileges thus cannot delete them. I was wondering if same could be achieved using setuid.– Osada LakmalOct 6, 2010 at 19:55
-
There is no permission system in the world that prevents stupid mistakes (while also allowing useful work to be done). This is what backups are for.– mswOct 7, 2010 at 3:24
Add a comment
|
2 Answers
If I understand you correctly, you have an application which is run by a normal user and whose associated files shall not be writeable by normal users to prevent accidental deletion. For this you do not need setuid. All you need to do is something along the lines of:
chown -R root.root /opt/theapp
chmod -R g-w /opt/theapp
chmod -R o-w /opt/theapp
chmod 755 /opt/theapp/bin/theexe
that means you give ownerships of the files to root, disallow all other users to write and allow every user to read and execute but not to write the executable.
I would say that this is generally a bad idea; in almost every case, you want your executables to have the same privileges you have, since you generally want to let the executable do whatever it's designed to do to your files. For example, if you made your text editor suid to an unprivileged user, you wouldn't be able to edit any text files...
