I find php files with SGID bit and read-only & execute. The group is root. Is this a problem?

Because a user will need to run the php interpreter with their our account, could it led to privilege escalation?

Like, the user www-data runing php as www-data and call the file with SGID bit, could he became root?

php path/to/file.php
  • 1
    Linux? The kernel has been configured by default to ignore both setuid and setgid of any interpreted executable script. – Christopher Jan 22 '19 at 13:05

Yes; sgid:root will run the file as root if run directly on an OS with sgid-on-!# enabled, and if the php file can be tricked into writing to an arbitrary file due to lack of input sanitation, etc.

That's a big IF but defence in depth is advised because bugs are plentiful..

Test suid;

./test.php && whoami

Where test.php contains

echo exec('whoami');

Allow setuid on shell scripts

Notes how modern implementations deal with interesting ways to take advantage of sgid


Notes the #! simlink attack was an issue from 1983 to 1993 before which shebang wasn't supported and after which it was more securely implemented.

  • Are sure? GUID set for script..... – Romeo Ninov Jan 22 '19 at 13:02
  • 1
    @user1133275, are you referring to a case where the OS applies setuid/setgid even on interpreted scripts? You might want to make that explicit, since AFAIK that's not very common. Even so, surely they wouldn't run the script as root (the user), if it only has the set_gid_ bit set? And if that happens, then surely the script runs with root's GID regardless of input sanitization problems? – ilkkachu Jan 22 '19 at 13:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.