Questions tagged [privileges]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
120
votes
8answers
28k views

Which is the safest way to get root privileges: sudo, su or login?

I would like to have the root account in safety even if my unprivileged user is compromised. On Ubuntu you can only use sudo for "security reasons" by default. However I am not sure it is any safer ...
74
votes
3answers
12k views

How do the internals of sudo work?

How does sudo work internally? How is it possible that it can become root without having the root password, unlike su? What syscalls, etc. are involved in the process? Is it not a gaping security hole ...
22
votes
3answers
29k views

GID, current, primary, supplementary, effective and real group IDs?

The following links discuss these concepts in different contexts. I have read their definitions, but I still can't tell how they are related, or if some of them are just the same. Current group ID ...
19
votes
1answer
49k views

Allow certain guests to execute certain commands

I would like to create a new user on some of my Debian/Ubuntu hosts that is able to update the server using the commands apt-get update and apt-get dist-upgrade, but I do not wan't to give them full ...
61
votes
6answers
109k views

Allowing a user to let listen to a port below 1024

I need to allow a user (different from root) to run a server listening on port 80. Is there any way to do this?
12
votes
5answers
12k views

How do I drop root privileges in shell scripts?

The "--up" option in OpenVPN is normally used for routing etc. And so it is processed before OpenVPN drops root privileges to run as nobody. However, I am invoking shell scripts that need to run as an ...
15
votes
1answer
18k views

Why does setuid not work? [duplicate]

I want to ensure that my program can only be run by user xyz using root privilege. To do this, I set the setuid bit with: chmod u+s program1.sh ls -l program1.sh rwsr-x--- 1 root house 1299 May 15 23:...
13
votes
1answer
4k views

root owned program with setuid bit on

Ping is a a program owned by root with the user id bit set. $ ls -l `which ping` -rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping As I understand it, if a user runs the ping process, then the ...
23
votes
2answers
50k views

lsof: WARNING: can't stat() fuse.gvfsd-fuse file system

What exactly is happening here? root@bob-p7-1298c:/# ls -l /tmp/report.csv && lsof | grep "report.csv" -rw-r--r-- 1 mysql mysql 1430 Dec 4 12:34 /tmp/report.csv lsof: WARNING: can't stat() ...
11
votes
5answers
9k views

Drop Process Privileges

I have a process that gets started by a damon running as root, now I want to "downgrade" this process's privileges to those of your average user. Is this possible? If yes how? PS: Running unix on a ...
35
votes
6answers
3k views

What is the safest way for programmatically writing to a file with root privileges?

A huge application needs, at one specific time, to perform a small number of writes to a file which requires root permissions. It is not really a file but a hardware interface which is exposed to ...
23
votes
8answers
5k views

Which access rights can't the superuser violate?

Fr. Br. George told in one of his lectures (it's in Russian) that there are some access rights that superuser can not violate. That is there are some access right which can forbid superuser doing ...
6
votes
2answers
3k views

Alternative to su/sudo on barebone system

I'd like to run some unit tests in a barebone chroot jail on Solaris. There's no su or sudo, and a copy of su (with libpam.so.1) just returns exit code 1 without any output, with or without parameters....
1
vote
2answers
109 views

Why do I need root-privileges to update my package manager's package list?

Why do I need root-privileges to update my package managers package list? Hi, I always wondered why I need root-privileges to update my package managers package list? I'm aware that the privileges ...
2
votes
3answers
5k views

Switching to superuser while shell script is running

I have a shell script that contains the following lines: CURRENT_USER=${USER} echo $CURRENT_USER su echo switch to `who am i` Once the 2nd line is executed, the shell prompts me to enter the root ...
1
vote
1answer
3k views

Disable “shutdown” and “poweroff” command in Ubuntu

I want to disable "shutdown" and "poweroff" CLI commands in Ubuntu for a specific user. How to do it?
10
votes
3answers
37k views

How to create an unprivileged user in CentOS?

I want to create an unprivileged user to run my RhodeCode server and Celery daemon on a CentOS instance. I think the accepted definition of this is no home directory, login disabled, and no shell ...
51
votes
2answers
130k views

What does the 's' attribute in file permissions mean? [duplicate]

Please compare the following two lines: -rws---r-x 1 root root 21872 2009-10-13 21:06 prg1 -rwx---r-x 1 root root 21872 2009-10-13 21:06 prg2 Does the setuid bit on prg1, along with the read and ...
11
votes
3answers
21k views

How does the set-user-ID mechanism work in Unix?

Can someone please explain the set-user-ID mechanism in Unix ? What was the rationale behind this design decision? How is it different from effective user id mechanism ?
10
votes
2answers
7k views

Why can an unprivileged user execute the `sync` command?

Currently on Ubuntu Linux, but I noticed this on other OSs too. Apparently any user can execute the sync command – but why is this? I can only see the disadvantage: system slow down due to unnecessary ...
22
votes
3answers
4k views

What script could allow regular users to use network namespaces?

I have an architecture using network namespaces (netns). I would like to allow regular users to do some operations in these netns. I could write a script netns-exec.sh, inspired by this post, ...
10
votes
7answers
92k views

How to run google chrome as root in linux

when I want to run google chrome as root, an error message with this title appears: Google chrome can not be run as root and the body of message is: to run as root, you must specify an ...
6
votes
1answer
461 views

How do DE's call ACPI functions?

Okay, first off, this is not a problem I am facing, but I would like to understand this better. If I wish to shutdown / reboot my machine from the command line I need to call: $ sudo poweroff $ sudo ...
20
votes
4answers
31k views

why does sudo work on Linux but not Android?

I have not had the chance to read enough about Android, Linux, or UNIX to answer this myself. sudo works on a Linux machine but doesn't work on Android unless you root the mobile device (e.g. Samsung ...
1
vote
1answer
348 views

How to find what ring a process is running on in Linux?

How can I find out which protection ring a given process is running in, and if possible can I produce a list of running processes with their respective rings? This thread gives some insight into what ...
6
votes
3answers
2k views

How can I set up Apache to use port 1 and other ports below 80?

The mysql user cannot use ports below 1024 because these are reserved for the root user. Apache, on the other hand, can use port 80. Apache runs as root before it runs as Apache and thus it can use ...
1
vote
1answer
1k views

Safe to change owner of OS X system folders?

I'm trying to get Homebrew to work. That program's diagnosis tool gives me these suggestions: You should probably chown /usr/local/etc ... You should probably chown them: /usr/local/...
1
vote
1answer
6k views

How to copy files as Jenkins “post build” action if i don't have privileges to destination directory

I have the following users "architecture" : root access is disabled. admin user have access only to its home directory. Apache runs as root service (root is the only one that have access to web-...
8
votes
4answers
2k views

How do I stop the root user from deleting a file?

I'd like to know if I can prevent the root user from deleting a file. Is it possible?
4
votes
2answers
3k views

How to update user/group settings of a running process?

Suppose I change some user settings like its initial login group or add it to a new group. I now can do su user and work with these new settings. But all the previously running processes will still ...
3
votes
1answer
400 views

USB-Insert Authentication for Linux

On Windows, when I insert a USB, I use USB Security. So I'd get "To allow USB access, enter a password." So I'd have to enter a password to be able to even view USB contents or run it. Is there such ...
2
votes
3answers
279 views

Why does FreeBSD require terminal programs to be started as root?

On FreeBSD all graphical terminal programs (e.g. xterm, rxvt) seem to be installed setuid root, or with setuid root wrappers. On Linux, this is not the case on any distribution I have ever used. Why ...
2
votes
1answer
2k views

How can I execute notify-send from root? [duplicate]

I'm working on a bash script which requires root privileges, but which I'd like to give the ability to notify a non-root user of certain alerts via notify-send in GNOME (or any other desktop shell ...
2
votes
0answers
182 views

Understanding getlogin spoofing [duplicate]

My question is in three (or so) related parts: 1) My understanding is that getlogin() will effectively return the auid associated with the process and so isn't actually changable by the user. Is that ...
2
votes
3answers
846 views

How to create a user account with specific permissions?

I want to create a unix user account with specific permissions: this user must be able to install software, but can't remove software. Furthermore, when the user logs in, root must receive a ...