-2
  1. Assume an executable file has its set-user-id bit on.

    When a process executes the executable file, it changes its effective user ID to the owner user ID of the executable file, after the kernel decides that the file can be executed via file access test. See https://stackoverflow.com/questions/41456225/how-and-when-does-exec-change-the-effective-user-id-when-the-set-user-id-is-s and What is the usage of set-user-ID of a program file?

    Does that means that the owner user ID of the executable file can be one which doesn't pass the file access test performed by the kernel, even if the test has already been passed based on the original effective user ID of the process ?

  2. Generally speaking, is it ever meaningful that the owner of an executable file doesn't have the execution permission?

Thanks.

  • Are you enabling the SUID bit on your own executables or something? On my system, I have exactly 16 executables that have the SUID bit set, and they all have to do with very specific system administration tasks (changing passwords, shutting down, changing to another user etc.). What is the practical application that requires you to set/modify the SUID bit? – Kusalananda May 2 '18 at 6:47
  • @Kusalananda I don't have any except for learning purpose. Thanks for letting me know. I found 22 by find /usr/bin -perm /6000 | wc -l and find /bin -perm /6000 | wc -l thanks to unix.stackexchange.com/a/180868/674 – Tim May 2 '18 at 11:12
2
  1. I have no idea how that works for certain (largely because I've never seen any use for such a configuration). My guess would be that it doesn't matter, because SUID effectively puts a seteuid() call at the very end of the startup process (right before executions transfers to the program itself), which would be after the file gets loaded for execution, and therefore once the check has happened as well (the check happens (at least on Linux) prior to any data being loaded into memory).

  2. That depends on what you mean by meaningful. It functionally does nothing, since the owner can just set the executable bit themselves (assuming no extra mandatory-access-controls that prevent them from doing so), so in that respect not really. As far as whether it's meaningful in the sense of being useful, I can't come up with any situations where it would make sense for the owner to not have execute permissions but other users do, so I would say no there as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.