Questions tagged [setuid]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-1
votes
3answers
40 views

How do I use a file with a setuid binary bit to access root?

I have a file with setuid binary permissions. I need to access root and I'm not sure how to do it with just this file. This is merely for practice purposes only. Will anyone help me?
1
vote
1answer
73 views

Common binaries with support for command execution, like `awk` and `vim`, not respecting setuid bit?

I'm hardening a Linux system and wanted to test (setuid-based) shell escapes using common binaries, like awk, vim, etc., supporting command executing. However, all binaries I've tested except sh and ...
0
votes
1answer
23 views

How do I make sure sudo is setuid in repackaged squashfs?

I'm trying to manipulate a squashfs file, containing a yocto build and an application payload, but everytime I do so, sudo fails to execute afterwards. root user is disabled, so I have no real ...
0
votes
0answers
25 views

How can a malicious seccomp filter cause an attempt to use `setuid(2)` to return 0, without actually making the system call?

I was reading the documentation on seccomp(2) on my Debian system, and stumbled upon the following sentence from the paragraph below: Such a malicious filter might, for example, cause an ...
0
votes
0answers
24 views

Can the process read the file? SetUID privilege collision

User A executes a setuid program owned by user B. the program wants to read a file in /etc/data, that is only readable by A and no one else. Can the program read the file? And then I have another ...
1
vote
1answer
131 views

setuid not working [duplicate]

I was trying to learn how setuid works. So I made a dummy program which just prints the current user: #include<bits/stdc++.h> using namespace std; int main(){ cout << system("id -...
0
votes
0answers
64 views

How to find files with the SUID bit set?

I am interested in finding all the files in the system that has the SUID bit set. The find / -perm 4755 command finds files that have the SUID bit set but with the permission of 755. But is there a ...
0
votes
1answer
86 views

Normal user run Qt C++ program as root without sudo?

I am writing a robotics program in C++, using Qt for the GUI, where each thread needs access to hardware. The library which accesses the hardware is called pigpio, and it modifies /dev/mem, so it ...
8
votes
1answer
227 views

Nano able to read on write-only access file

User has write-only permissions on a file, unable to cat or vi but is able to nano normally. How is this possible? I was wondering what happens if you only have write-access on a file and this was ...
-1
votes
1answer
49 views

Why can't I setuid binaries like apt?

During all my education I've been taught that the setuid would allow anyone that has the execution privilege on a file to run it as the owner. However it seems that I'm not able to setuid a binary and ...
1
vote
2answers
251 views

Questions about the saved user ID

As far as I understood the different user IDs are as follows (from the perspective of a process): real user ID: the user ID that owns the process effective user ID: the user ID which determines what ...
2
votes
1answer
251 views

Why doesn't setuid() work with non-root users?

I'm experiencing a weird behavior regarding setuid() and the setuid bit. It seems like the suid bit and setuid() do not work as expected. I am expecting for a binary with +s and owned by uid 1001 ...
1
vote
1answer
70 views

How to implement setuid bit? [duplicate]

I created a small script as the root user... #!/bin/bash cat /etc/shadow and set the setuid bit and placed it within the guest folder. When I ran the script as guest, it showed permission denied. ...
0
votes
1answer
373 views

Set-UID Capability Leak Attack

I have a C program to demonstrate the capability leak attack regarding set-uid. // cap_leak.c #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <fcntl.h> ...
8
votes
2answers
940 views

Why does the setuid bit work inconsistently?

I wrote the code: // a.c #include <stdlib.h> int main () { system("/bin/sh"); return 0; } compiled with command: gcc a.c -o a.out added setuid bit on it: sudo chown root.root a.out sudo ...
0
votes
1answer
39 views

How to Run the command or script through any user in linux? [closed]

I am having a C executable in AIX system by which I can run the command through any user like root or system users. script having below permissions. On AIX server lrwsrwxrwx 1 root system 24 ...
0
votes
2answers
475 views

How to resolve sudo error in RHEL7

I am not able to use sudo, how to resolve this ? $ sudo vi /etc/fstab sudo: effective uid is not 0, is sudo installed setuid root?
1
vote
0answers
102 views

Applying special permission suid & sgid

I was in the processs of learning a bit about the special permission in Linux. Where is find certain anomilies. suid - For executable/files where user subsume the UID/permission of the owner. With ...
1
vote
0answers
149 views

seteuid fails even when all UIDs are 0

I have some C++ code on a Linux machine whose purpose is to run some code as an arbitrary user. #include <sys/capability.h> #include <unistd.h> void doAsUser(uid_t uid) { if (...
2
votes
1answer
80 views

ID inheritance – Which IDs?

I'm learning UNIX file permissions / ID inheritance and would like to clarify something: I have this list of permissions, users, groups and files: -rwxr-xr-x userA A foo -rw-rwsr-x userB B bar ...
2
votes
2answers
290 views

suid executable not elevating permissions but `sudo` does elevate

I'm trying to write a program that will quickly shut down a laptop without prompting for a password or confirmation. The laptop is running Linux, specifically Manjaro. To that end, I'm trying to make ...
2
votes
1answer
764 views

Is it possible to apply setuid only for a specific user?

As I understand, the setuid bit means that any user who can execute a file executes it as the file's owner. Is it possible, using ACLs or something, so that only a select list of users execute the ...
0
votes
1answer
159 views

How can I prevent a process to change its setuid bit back to RUID within the process itself

I set my SETUID bit to a non-root user so that the process should take the ownership of that executable file always. But I figured out setuid bit can be changed back to RUID within the script itself. ...
7
votes
1answer
337 views

Root privileges can be restored after setuid(1000) in musl libc

musl libc allows you to change uid to root even after supposedly dropping permissions with setuid(1000). I am not able to reproduce the problem with glibc. Code: #define _GNU_SOURCE #include <...
1
vote
2answers
879 views

why do we need the SUID permission? [closed]

Please read this long intro to understand my concern for why we need the SUID permission for executable binary file. A process in Linux uses its EUID to know the effective User ID of itself. This ...
4
votes
1answer
738 views

Why I can not drop sudo root privileges?

I am debugging a program and not quite sure why I can not drop privileges. I have root permissions via sudo and I can call setgid/setuid, but the operation [is] is not supported. Basic code to ...
0
votes
0answers
74 views

Always run script as root [duplicate]

I want to run a command automatically. The problem is that it may only be run after I logged in and that it requires superuser privileges. I've heard of suid before, so I thought I'd use it for this. ...
1
vote
1answer
219 views

Linux - why do the su and sudo binaries need to be set-UID root?

I am trying to find the correct reason for the stated question. My understanding is that: sudo needs to read the /etc/sudoers file which is only readable by root, which is why it needs to be set-UID ...
0
votes
1answer
707 views

Why can't unprivileged users nest FUSE mounts, but they can mount FUSE inside NFS with root_squash?

$ mkdir mnt $ bindfs /tmp mnt fusermount: option allow_other only allowed if 'user_allow_other' is set in /etc/fuse.conf $ bindfs --no-allow-other /tmp mnt $ mkdir /tmp/mnt2 $ bindfs --no-allow-...
2
votes
1answer
559 views

How does Magisk on Android work as su without setuid and capabilities?

I've read in another answer that on Android the su binaries avoid needing to be setuid by using filesystem capabilities like cap_setuid. But then I tried to check this, and to my surprise, I found no ...
0
votes
1answer
564 views

Adding suid to a binary file [duplicate]

My question is about suid! The logic behind that is to grant root permission when a privileged command is executed by a user. For example, passwd has such a feature. $ ls -l /usr/bin/passwd -rwsr-xr-...
1
vote
0answers
86 views

Setuid program loses group memberships

I am upgrading an older SuSE-13.2 box to Leap-15. I have done a fresh Leap-15.0 install and ported over the source code that we ran on the 13.2 box. I builds fine but I am having an issue. The program ...
0
votes
1answer
545 views

Linux Setuid special permission flag with read/write

Does the setuid is only applicable for execute file(only applicable with executable flags) ? How it will affect other permission(read/write) of same file ! Eg:- If the the actual file permission is ...
2
votes
1answer
487 views

Does su always change ruid, euid and suid to the same user id?

Does su always change ruid, euid and suid to the same user id, or just some of them? I feel all of them, because the process which is executing su is always run with superuser privileges, and in ...
10
votes
4answers
4k views

Which user's password does `sudo` asks for?

$ ls -l /usr/bin/sudo -rwsr-xr-x 1 root root 136808 Jul 4 2017 /usr/bin/sudo so sudo is runnable by any user, and any user who runs sudo will have root as the effective user ID of the process ...
-2
votes
1answer
88 views

Is it ever meaningful that the owner of an executable file doesn't have the execution permission?

Assume an executable file has its set-user-id bit on. When a process executes the executable file, it changes its effective user ID to the owner user ID of the executable file, after the kernel ...
1
vote
0answers
248 views

Confused about using `setuid` on a FreeBSD mounted dataset to ensure all files/dirs have a fixed owner?

Initially I thought that what I'm trying to do was simple. But the more I look at FreeBSD man pages, the more confused I'm getting about whether it's even possible. I have a zfs pool that is used for ...
1
vote
0answers
166 views

setuid confusion, change owner of files created to particular user:group

I am trying to setup a directory /opt/www in such a way that when a user who belongs to the group django creates/modifies files and directorys within, they are set to owner django and group django. I ...
-1
votes
1answer
198 views

What tasks still require the suid bit on modern systems? [closed]

The setuid concept appears to become gradually obsolete, being replaced by proper permissions and authentication models in the few cases it is still in use. Examples: ping has been converted to use ...
0
votes
3answers
14k views

sudo must be owned by uid 0 and have the setuid bit set

I have changed my ubuntu super password by recovery mode after that i can't run my sudo command in normal user i have attempted to crack my previous password in Recovery mode i followed this ...
1
vote
3answers
941 views

why setuid is set instead of giving privileges to others

Assuming the normal user wants to update his password at /etc/passwd. Why it is preferable to set Setuid in a way such as -rws------ . I am assuming it works the same as if the other users will be ...
1
vote
1answer
781 views

How does android implement run-as without setuid

Earlier versions of Android have at run-as executable with the setuid flag set so it runs as root, but more recent versions do away with that. What changed? How can the shell user effect a user change?...
3
votes
1answer
737 views

Do I need to set SUID when I run a script as `sudo`?

I need to run a script as root. The instructions given in the link say that I ought to: Set the SETUID bit on the script (i.e. chmod 4755). Run the script as sudo (i.e. sudo /path/to/thescript.sh) ...
0
votes
1answer
276 views

How to drop privilege of root user initiated process?

I would like to start JBoss process with root user, because I have to bind ports (<1024). But after initiating the process, I have to drop privilege of the initiated process. Is it possible? If ...
1
vote
1answer
466 views

Linux open() syscall and folder permissions

I have a process P which is spawned by a process owned by root. After P is created setguid() and setuid() are called and it runs as user U. The process P attempts to create a file f on a folder F (in ...
2
votes
0answers
91 views

modprobe in setuid contextmodprobe in setuid context

In CVE-2017-0358, author notes that The issue is that /sbin/modprobe is not designed to run in a setuid context. As the manpage of modprobe explicitly points out The MODPROBE_OPTIONS environment ...
2
votes
3answers
12k views

What is required by a process to set its uid to 0 (root)?

I am completely new to *NIX based OSes. One of the things that baffles me is that a process or program may execute setuid(0) and then perform privileged operations and revert back to its normal uid. ...
2
votes
1answer
269 views

how to run setuid task properly?

Assuming there is a php website and I want to block an ip at the firewall level based on the site code execution. The site is run under non-root user. I was going to pass IP from the site code to a ...
1
vote
1answer
424 views

How is PAM checking the user password in unprivileged processes?

PAM manages to check the user password, when called from unprivileged screen-lockers. E.g.: Password for GNU screen lockscreen command? https://github.com/google/xsecurelock I can't find any SUID-...
0
votes
0answers
309 views

SETUID and SETGID Behavior

The setup: ~$ ls -l /etc/sudoers -r--r----- 1 root root 614 2017-09-10 20:29 /etc/sudoers ~$ ls -l /etc/shadow -rw-r----- 1 root shadow 794 2011-04-18 11:49 /etc/shadow $ ls -l $(which ht) -rwsr-sr-...