1

When I was studying the manual page for command pmount I read the following:

pmount ("policy mount") is a wrapper around the standard mount program which permits normal users to mount removable devices.

And when I used pmount /dev/sdc1 (without sudo) as a normal user, it created a folder named /media/sdc1 folder, while the permissions for the system's /media folder are drwxr-xr-x and it is owned by root. This means that a normal user (currently, me) cannot create files and folders in /media folder.

Doesn't this contradict the rules of permissions and ownership in Linux?

Another question is that while mount requires superuser permissions, and pmount uses mount internally, how is it possible to use pmount without sudo?

1 Answer 1

3

/usr/bin/pmount is a setuid binary. When running a setuid executable, the uid or gid is changed to executable's owner. When executing pmount, the process will have root privileges and can therefore create root owned directories and mount filesystems.

Same setuid mechanism also applies to sudo.

4
  • Then doesn't this decrease the security of the system? Should I remove "pmount" package and its dependeicnes? Commented Aug 4, 2017 at 10:06
  • @Hedayat Yes, setuid binaries can be used by attackers and decrease the security of the system. But without them, you wouldn't be able to do things like change your own password since your password is usually stored securely so normal users can't even read the storage. Some required actions on a system may only be done by setuid binaries - such as using the already-mentioned sudo to change to another user. If users need to do what pmount provides, you'll need to keep it. If they don't, yes you would make your system a bit more secure by removing the package. Commented Aug 4, 2017 at 10:26
  • Thank you dear Andrew. How can I understand whether a command is a setuid binary or not? Commented Aug 4, 2017 at 10:38
  • You can inspect executables /bin /usr/bin with ls -l to see if the setuid/setgid bits are set. If you want to find all files with setuid or setgid bit set you can do that using find eg. find / -perm /6000.
    – sebasth
    Commented Aug 4, 2017 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .