We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [privileges]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
121
votes
8answers
28k views

Which is the safest way to get root privileges: sudo, su or login?

I would like to have the root account in safety even if my unprivileged user is compromised. On Ubuntu you can only use sudo for "security reasons" by default. However I am not sure it is any safer ...
74
votes
3answers
12k views

How do the internals of sudo work?

How does sudo work internally? How is it possible that it can become root without having the root password, unlike su? What syscalls, etc. are involved in the process? Is it not a gaping security hole ...
63
votes
6answers
113k views

Allowing a user to let listen to a port below 1024

I need to allow a user (different from root) to run a server listening on port 80. Is there any way to do this?
57
votes
2answers
139k views

What does the 's' attribute in file permissions mean? [duplicate]

Please compare the following two lines: -rws---r-x 1 root root 21872 2009-10-13 21:06 prg1 -rwx---r-x 1 root root 21872 2009-10-13 21:06 prg2 Does the setuid bit on prg1, along with the read and ...
35
votes
6answers
3k views

What is the safest way for programmatically writing to a file with root privileges?

A huge application needs, at one specific time, to perform a small number of writes to a file which requires root permissions. It is not really a file but a hardware interface which is exposed to ...
25
votes
2answers
53k views

lsof: WARNING: can't stat() fuse.gvfsd-fuse file system

What exactly is happening here? root@bob-p7-1298c:/# ls -l /tmp/report.csv && lsof | grep "report.csv" -rw-r--r-- 1 mysql mysql 1430 Dec 4 12:34 /tmp/report.csv lsof: WARNING: can't stat() ...
23
votes
8answers
5k views

Which access rights can't the superuser violate?

Fr. Br. George told in one of his lectures (it's in Russian) that there are some access rights that superuser can not violate. That is there are some access right which can forbid superuser doing ...
23
votes
3answers
4k views

What determines which Linux commands require root access?

What determines which Linux commands require root access? I understand the reasons why it is desirable that, say, apt-get should require root privilege; but what distinguishes these commands from the ...
22
votes
3answers
30k views

GID, current, primary, supplementary, effective and real group IDs?

The following links discuss these concepts in different contexts. I have read their definitions, but I still can't tell how they are related, or if some of them are just the same. Current group ID ...
22
votes
3answers
4k views

What script could allow regular users to use network namespaces?

I have an architecture using network namespaces (netns). I would like to allow regular users to do some operations in these netns. I could write a script netns-exec.sh, inspired by this post, ...
21
votes
4answers
32k views

why does sudo work on Linux but not Android?

I have not had the chance to read enough about Android, Linux, or UNIX to answer this myself. sudo works on a Linux machine but doesn't work on Android unless you root the mobile device (e.g. Samsung ...
19
votes
1answer
52k views

Allow certain guests to execute certain commands

I would like to create a new user on some of my Debian/Ubuntu hosts that is able to update the server using the commands apt-get update and apt-get dist-upgrade, but I do not wan't to give them full ...
16
votes
3answers
8k views

What are benefits and downsides of unprivileged containers?

The technical explanation of what is unprivileged container is quite good. However, it is not for ordinary PC user. Is there a simple answer when and why people should use unpriviliged containers, and ...
15
votes
1answer
20k views

Why does setuid not work? [duplicate]

I want to ensure that my program can only be run by user xyz using root privilege. To do this, I set the setuid bit with: chmod u+s program1.sh ls -l program1.sh rwsr-x--- 1 root house 1299 May 15 23:...
15
votes
3answers
1k views

make all the processes of a given user killable by anyone

On a shared server, I would like to have some very low priority users such that whenever an other user (also without root privileges) needs the resources, they can kill any of the low priority users' ...
15
votes
2answers
7k views

Vulnerability demonstration on Ubuntu 9.04

For a class on IT security, I want to demonstrate privilege escalation to the students. To do so, I looked through the exploit/linux/local list in the Metasploit Framework, finding (among others) ...
13
votes
1answer
4k views

root owned program with setuid bit on

Ping is a a program owned by root with the user id bit set. $ ls -l `which ping` -rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping As I understand it, if a user runs the ping process, then the ...
12
votes
5answers
9k views

Drop Process Privileges

I have a process that gets started by a damon running as root, now I want to "downgrade" this process's privileges to those of your average user. Is this possible? If yes how? PS: Running unix on a ...
12
votes
5answers
13k views

How do I drop root privileges in shell scripts?

The "--up" option in OpenVPN is normally used for routing etc. And so it is processed before OpenVPN drops root privileges to run as nobody. However, I am invoking shell scripts that need to run as an ...
11
votes
3answers
62k views

How to give user root permissions?

I just installed Arch. Works great. I created a new user, logged in with it and now I'm trying to install several things with pacman. But I keep getting the error: error: you cannot perform this ...
11
votes
2answers
7k views

Why can an unprivileged user execute the `sync` command?

Currently on Ubuntu Linux, but I noticed this on other OSs too. Apparently any user can execute the sync command – but why is this? I can only see the disadvantage: system slow down due to unnecessary ...
11
votes
3answers
22k views

How does the set-user-ID mechanism work in Unix?

Can someone please explain the set-user-ID mechanism in Unix ? What was the rationale behind this design decision? How is it different from effective user id mechanism ?
11
votes
3answers
40k views

Run script as a different user from root [closed]

From root user, how can I give permissions to another user to execute the file /root/script.sh ? The idea is to run the script like sudo -u user1 /root/script.sh
11
votes
4answers
2k views

Does managing cgroups require root access?

I am trying to work with control groups on two different operating systems (Ubuntu and CentOS). There are few concerns that I would like to ask. I am trying to create a control group using the ...
10
votes
3answers
38k views

How to create an unprivileged user in CentOS?

I want to create an unprivileged user to run my RhodeCode server and Celery daemon on a CentOS instance. I think the accepted definition of this is no home directory, login disabled, and no shell ...
10
votes
2answers
26k views

Launch process as another user/group (in init.d script)

I am editing a init.d script. The init.d script runs a utility script which then runs an process. From either bash scripts how would I make it launch the main process as a specific user and group?
10
votes
7answers
96k views

How to run google chrome as root in linux

when I want to run google chrome as root, an error message with this title appears: Google chrome can not be run as root and the body of message is: to run as root, you must specify an ...
9
votes
2answers
8k views

Bash cannot act as nobody and nogroup?

I have a log file that was created by nobody:nogroup, which is activity being logged to, I wanted to emulate adding a message to that log file. My first thought was to: $ sudo su nobody This account ...
9
votes
2answers
38k views

I'm not getting privileges, edited /etc/sudoers [duplicate]

I want to run any program without asking root password. Because I'm the only person who use the system. So I googled and edited /etc/sudoers. What I did: # chmod 640 /etc/sudoers # vim /etc/sudoers ...
8
votes
6answers
2k views

Allow regular users to SSH using a private key they cannot read

Let's say I have a set of machines (called here the customers' machines) that only a small list of people (called the support staff) is allowed to SSH into, using only one account by machine (the ...
8
votes
4answers
2k views

How do I stop the root user from deleting a file?

I'd like to know if I can prevent the root user from deleting a file. Is it possible?
8
votes
2answers
820 views

Why does the setuid bit work inconsistently?

I wrote the code: // a.c #include <stdlib.h> int main () { system("/bin/sh"); return 0; } compiled with command: gcc a.c -o a.out added setuid bit on it: sudo chown root.root a.out sudo ...
7
votes
3answers
3k views

Is it possible to run 'unshare -n [program]' as an unprivileged user?

I want to run a program without any internet access, e.g. unshare -n ping 127.0.0.1. As an unprivileged user, it returns Operation not permitted, as a privileged user, it returns the desired ...
7
votes
6answers
1k views

Detecting cron tasks run by another user

I am currently working through the Nebula challenges on exploit-exercises.com, and one of the challenges relies on a script being run by cron. This is run by another user (flag03) and the user I am ...
6
votes
3answers
2k views

How can I set up Apache to use port 1 and other ports below 80?

The mysql user cannot use ports below 1024 because these are reserved for the root user. Apache, on the other hand, can use port 80. Apache runs as root before it runs as Apache and thus it can use ...
6
votes
3answers
423 views

Is it my job as a Linux admin to drop root privileges of applications, or the application developers job? [closed]

As a Linux admin, is one of my jobs to carry out some sort of task to drop root privileges of the applications running on my systems? Or do I simply rely upon the application developers to ensure ...
6
votes
2answers
4k views

Purpose of using setuid() in SUID programs

I wonder that an SUID program like passwd is using the setuid() function call. Why does it drop root privileges? Against what types of attack does this help? Buffer-overflow?
6
votes
3answers
2k views

How can a file manager mount a drive without root?

I've been reading this question about why mount must be run as root (with some exceptions), and I was wondering, if mounting a drive requires root (generally), how does a graphical file manager (...
6
votes
3answers
17k views

sudoer file how to give a particular user full access to only certain file

I want to give a user full access to only certain files, can someone show me how to do that? For example, I want to modify the sudoer file to grant user access to only certain file. Thanks.
6
votes
2answers
3k views

Alternative to su/sudo on barebone system

I'd like to run some unit tests in a barebone chroot jail on Solaris. There's no su or sudo, and a copy of su (with libpam.so.1) just returns exit code 1 without any output, with or without parameters....
6
votes
1answer
464 views

How do DE's call ACPI functions?

Okay, first off, this is not a problem I am facing, but I would like to understand this better. If I wish to shutdown / reboot my machine from the command line I need to call: $ sudo poweroff $ sudo ...
5
votes
3answers
9k views

cant add user to sudo group in centOS 7 i386(no GUI,Its minimal)

I had install centOS 7 minimal version in my virtualbox in Ubuntu mate. It has no GUI. It is totally CLI. My user name is Smit and able to login in to it. But when i type command sudo yum update and ...
5
votes
3answers
5k views

Which Linux capability do I need in order to write to /proc/sys/vm/drop_caches?

I am trying to clear my filesystem cache from inside a docker container, like so: docker run --rm ubuntu:vivid sh -c "/bin/echo 3 > /proc/sys/vm/drop_caches" If I run this command I get sh: 1: ...
5
votes
2answers
5k views

Privileged mode in bash

I've used bash for years but I 've stuck with the"privileged mode" that it can be configure with the set command. For example: set -p I've read the bash man page but it's somewhat obscure. For ...
5
votes
2answers
762 views

How do daemons like apache or bind open ports below 1024?

I know that ports below 1024 are protected and can't be opened by a user without sufficient permission. However, I'm wondering how daemons such as bind or apache can do so, though they aren't running ...
5
votes
3answers
2k views

Shell/Bash script: Properly drop privileges

Okay, first of all, I know this question has been asked a few times here, but the answers given did not entirely satisfy me. The situation is the following: I have written many scripts to automate ...
5
votes
1answer
1k views

From which version does Bash drop privileges?

I've been trying to do some buffer overflow attack, and I thought I could use system("/bin/bash") in order to obtain a root shell. Then I read the documentation for system(). It says: system() ...
5
votes
1answer
2k views

Who can change ACL permissions?

I'm using ACL to control access to individual roots of webs for different instances of Apache and different groups of admins. I've got a Unix group admins-web22 for admins of a particular website and ...
5
votes
1answer
1k views

Run command with sudo by default

I need a linux user (lets call him "bob") who is allowed to run a list of commands which require root privileges. So let him be required to run /sbin/firstcommand and /sbin/secondcommand (which are ...
4
votes
3answers
10k views

How does mmap'ing /dev/mem work despite being from unprivileged mode?

As far as my understanding goes, User space programs run in the unprivileged mode, and thus do not have direct access to memory or I/O. Then how exactly can we directly access memory or I/O locations ...