1

When I was studying the manual page for command pmount I read the following:

pmount ("policy mount") is a wrapper around the standard mount program which permits normal users to mount removable devices.

And when I used pmount /dev/sdc1 (without sudo) as a normal user, it created a folder named /media/sdc1 folder, while the permissions for the system's /media folder are drwxr-xr-x and it is owned by root. This means that a normal user (currently, me) cannot create files and folders in /media folder.

Doesn't this contradict the rules of permissions and ownership in Linux?

Another question is that while mount requires superuser permissions, and pmount uses mount internally, how is it possible to use pmount without sudo?

3

/usr/bin/pmount is a setuid binary. When running a setuid executable, the uid or gid is changed to executable's owner. When executing pmount, the process will have root privileges and can therefore create root owned directories and mount filesystems.

Same setuid mechanism also applies to sudo.

  • Then doesn't this decrease the security of the system? Should I remove "pmount" package and its dependeicnes? – Hedayat Mahdipour Aug 4 '17 at 10:06
  • @Hedayat Yes, setuid binaries can be used by attackers and decrease the security of the system. But without them, you wouldn't be able to do things like change your own password since your password is usually stored securely so normal users can't even read the storage. Some required actions on a system may only be done by setuid binaries - such as using the already-mentioned sudo to change to another user. If users need to do what pmount provides, you'll need to keep it. If they don't, yes you would make your system a bit more secure by removing the package. – Andrew Henle Aug 4 '17 at 10:26
  • Thank you dear Andrew. How can I understand whether a command is a setuid binary or not? – Hedayat Mahdipour Aug 4 '17 at 10:38
  • You can inspect executables /bin /usr/bin with ls -l to see if the setuid/setgid bits are set. If you want to find all files with setuid or setgid bit set you can do that using find eg. find / -perm /6000. – sebasth Aug 4 '17 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.