1

I'm running a program from the init script in early user space, before the main root fs is mounted.

Is it possible to run an application here without root privileges?

The obvious issue being that there is no "users" as this very early point in the boot process.

2

Is it possible to run an application here without root privileges?

Sure it is. Assuming linux has been compiled with MULTIUSER support ;)

The obvious issue being that there is no "users" as this very early point in the boot process.

Well, yeah, if you try to put su or sudo on the initramfs, you will need to add a lot of configuration files (/etc/passwd, /etc/groups, /etc/shadow and so forth). But these complexities are not inherent to Linux. After all, UID is just a number, so it's very easy to make a toy program that can drop root privileges if that is your goal:

#include <stdlib.h>
#include <unistd.h>
int main(int argc, char** argv)
{
  setuid(atoi(argv[1]));
  execvp(argv[2], argv+2);
}

If you compile it as toysu, it can invoked thus:

toysu 1234 touch /tmp/example

where 1234 is the UID to use and the rest is the command to run. Note that it won't work unless you are root to begin with, so prefix that command with sudo to test it from a normal system.

  • So do I need to create a user id with lower privileges? Take for example nginx, which I believe drops its privileges after starting - do I need to do any uid related work to ensure it has a new uid to drop to? Do my questions even make sense? – Duke Dougal Dec 2 '16 at 5:16
  • 1
    @DukeDougal At the level of Linux kernel, UID is just a number. Only UID=0 is treated specially by the kernel, to restrict system calls that require root, and to grant all file accesses for root regardless of permissions. The Linux kernel does not know about /etc/passwd, home directories, or any of that jazz. All that is implemented by tools like su and login. For the Linux kernel, any 32-bit number is a valid UID that you can setuid to. – DepressedDaniel Dec 2 '16 at 5:22
  • Not actually quite true. The kernel reserves some numbers. – JdeBP Dec 2 '16 at 7:49
  • @JdeBP Ok, almost any 32-bit number. Excluding 2^16-1, 2^16-2 and 2^32-1. – DepressedDaniel Dec 2 '16 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.