Consider the following two files. summarize's executable UID bit has been set, so that another user belonging to another group can execute the summarize executable that uses the customers.dat file.

-rw-------  steve  sales  customers.dat
-rwsr-xr-x  steve  sales  summarize

Now consider the following two files:

-rwxrwx--- 1 root   root   5974 May 17 13:53 1.out
-rwsrwsrwx 1 root   root   5970 May 17 14:03 a.out

Both are executables, and I want that some other user runs a.out, which calls 1.out within itself using the system("./1.out"); call.

But I am always getting permission denied error

sh: ./1.out: Permission denied

To me, both scenarios look the same. Why do I get the permission denied error? Am I missing something?


Extract from Set-UID Programs and Vulnerabilities:

– Recall that system() invokes /bin/sh first. In Fedora, it execv /bin/sh with arguments "sh", "-c" and the user provided string.

– In Fedora, /bin/sh (actually bash) ignores the Set-UID bit option. Therefore, when invok- ing system (cmd) in a Set-UID program, cmd will not be executed with the root privilege, unless cmd itself is a Set-UID program. The following code in bash drops the Set-UID bit. Actually, I cannot think of any legitimate reason why we need to allow Set-UID shell program. Fedora is doing the right thing; many other Unix OSes have not done this.

According to this 1.out is not set uid and a.out drops privileges before executing it.

| improve this answer | |
  • so isnt there a way to code an ececutable that has root privileges which invokes other commands that are supposed to be run under root permissions on its behalf? – ashishsony May 17 '12 at 22:32
  • 1
    I imagine (not tested) that making 1.out set uid as well would accomplish what you want. Whether or not that's secure is something I can't judge. One problem I can imagine is that the user who's able to run a.out would be able to call 1.out directy. There might be bigger security problems than this though. – Bram May 18 '12 at 7:37
  • You can certainly exec(3) programs. – vonbrand Jan 19 '13 at 23:38
  • Your permissions on the SUID executable include write permissions for other people, any halfway sane kernel will refuse to run that. – vonbrand Jan 19 '13 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.