Is there a way to force to run program as root (with normal user) when there's no sudo on the machine (and can't be added)?

  • You could just limit the commands they can run via sudo using the sudoers file – Drake Clarris Jun 17 '13 at 17:47
  • There's no sudoers file. – MadBoy Jun 18 '13 at 10:52
  • I really must have misread this - I could have sworn it had asked about an alternative to sudo, and I was thinking sudo would work just fine... My bad. I missed it not having sudo at all – Drake Clarris Jun 18 '13 at 12:18

Sure: you can set the setuid bit. On a modern system, the simplest command is:

# chmod u+s myprogram

or, if the program is already known to have mode 755:

# chmod 4755 myprogram

This assumes the program is owned by root. You'll need to change the file's owner, too, if it is currently owned by someone else.

Do read that Wikipedia article, particularly the Security section. There's a reason only root can do this to a file, and why few executables on your system have this bit set already.

| improve this answer | |
  • What about commands like "ulimit -c unlimited" and others? Basically the goal is to give access to some high commands that are used by developers who do testing of the code they created (on the network level) on that Linux machines but they did couple of wrong moves already when being a root user so we want to prevent damage done by them done by accident - like changing root passwords to empty. – MadBoy Jun 17 '13 at 15:00
  • The objective is not to protect the system from compromising, but from screwing it up. Those "linux" are kind of development testing machines. We need to give them ability to do their job without affecting everyone else. – MadBoy Jun 17 '13 at 15:02
  • If the root user has already set a too-low core limit size and you cannot change this, you're pretty much stuffed. They're not likely to let you go setting setuid bits on executables in the first place. If for some reason the site admins you're dealing with are that demented, keep in mind that /usr/bin/ulimit is typically masked by the ulimit shell builtin command. You'll need to specify the path to the program if you want to get its effect as root. – Warren Young Jun 17 '13 at 15:10
  • Thank you. Your help was very appreciated. Hopefully this will be enough. – MadBoy Jun 17 '13 at 15:23
  • @MadBoy: I should also point out that I think simply setting this bit on the ulimit executable is a bad idea. It would mean any user on that system could change their user limits, since they'd be running as root. Plus, the program probably hasn't been audited with setuid in mind. You could modify the scheme a bit, e.g. chmod 4750 /usr/bin/ulimit ; chgrp developers /usr/bin/ulimit, and put all devs needing this more powerful ulimit command in the developers group. Then normal users can't call it, but their needs might be met by the shell builtin. – Warren Young Jun 17 '13 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.