Questions tagged [setuid]
The setuid tag has no usage guidance.
190
questions
1
vote
0
answers
26
views
Why does setreuid have this limitation on setting ruid to current value of suid?
According to the docs for setreuid:
Unprivileged processes may only set the effective user ID to the real user ID, the effective user ID, or the saved set-user-ID.
Unprivileged users may only set ...
- 195
0
votes
0
answers
33
views
SETUID not executing the script as owner when executed via PHP script
I have a sh file (with setuid) that I want specific web users to be able to execute from an endpoint:
-rwsr-xr-x 1 root root 59 Sep 11 09:47 restart-workers.sh
The content of this file is ...
- 101
0
votes
0
answers
28
views
ACL implementation using setuid
I am working on an assignment that mainly deals with the following topic:
The main idea is to run a program as fakeroot that elevates the privileges of one user to read the file of the owner. If ...
- 1
0
votes
1
answer
82
views
Why does adding a user and setting an SUID for it throws me the "Operation not permitted" error?
I am setting SUID for a new user tommy to run the same commands as root but it goes down like this:
[root@192 ~]# useradd tommy
[root@192 ~]# su - tommy
[tommy@192 ~]$ chmod u+s /usr/bin/ls
chmod: ...
- 1
-3
votes
2
answers
184
views
What is the effect of the "s" permission bit on a file?
I have two files with the following permissions:
-rwsr--r-- 1 root root 213 Oct 22 12:15 f1
-r--rwxr-- 1 Bob staff 113 Oct 22 12:18 f4
Can the user Bob execute f1 and why? What is the effect of the ...
1
vote
1
answer
148
views
SETUID not effective when calling cat from AWK script from C program
Consider the following simplified example which illustrates my problem.
The server's OS is Debian 11 armhf.
we're in directory /botm/test/:
drwx------ 2 b b 4096 Sep 27 19:27 hide
-rwsr-xr-x 1 b b ...
0
votes
0
answers
115
views
I have an Apache2 CGI executable trying to use setgid()/setuid(). But it fails switching to root. How do I fix that issue?
My CGI executable starts as expected. At some point, though, it tries to become root (and then yet a different user). At that point, the CGI fails.
Here is the pertinent code snippet:
[...]
int const ...
- 2,705
2
votes
1
answer
49
views
Is it impossible to run mount(1) from a setuid program?
I have a setuid program which, among other things, needs to remount a normally-readonly disk so it can write to it. That is, the program wants to run the command
mount -o remount,rw /
But the mount ...
- 517
-1
votes
1
answer
331
views
passwd source code
I am trying to look at the source code of the passwd and gpasswd programs. These tools check the effective UID set to zero to complete execution successfully. But I am a noob to C and couldn't find ...
- 131
10
votes
2
answers
1k
views
Source of passwd error messages
I am testing if the passwd command could run if the setuid bit is disabled. I disabled the setuid by running the following command:
chmod 0554 /bin/passwd
After doing so, I tested if the passwd ...
- 131
1
vote
1
answer
531
views
Is appropriate to use setuid() over setresuid()/setreuid()/seteuid()?
I have an executable binary which was compiled from a C source file
The executable has the setuid permission on
I noticed that, if the owner of the executable is root, I can use
setuid(geteuid());
...
- 15
0
votes
0
answers
228
views
debugger as a tool to get to root shell
according to the answer in the reference:
Can gdb debug suid root programs?
Claims that:
"You can only debug a setuid or setgid program if the debugger is running as root. The kernel won't let ...
2
votes
2
answers
489
views
Why I can't set the setuid for "others"?
I can't set other's setuid bit. Why? Is there some security lock?
$ ls -l
-rwxrwxr-x 1 allexj allexj 16784 Mar 11 17:30 a....
- 261
2
votes
1
answer
353
views
Why "permission denied" when running `less` with chmod 6110?
Assume you are user x, so running id gives
uid=1001(x) gid=1001(x) groups=1001(x)
And there is also a user y with
uid=1002(y) gid=1002(y) groups=1002(y)
Now as root we create a file readme in user's ...
- 68
0
votes
1
answer
173
views
What are the effective permissions if a setuid program is executed via sudo?
I have read many questions and answers about how the setuid bit works and about how sudo works, and I think I have understood that stuff.
However, I couldn't find out what should happen when a program ...
- 3,180
0
votes
1
answer
264
views
Not able to assign root privilege to my process again by using setuid(0) in the same boot cycle
I have added the capability by using following cmd on terminal (alternative of setting CAP_SETUID in drop-in file). Verified that setuid/seteuid is working.
setcap cap_sys_admin,cap_setuid+ep /...
0
votes
1
answer
289
views
Why don't I find ping process in ps list?
Why can't I see the 'ping' process in my 'ps' listing when I started it as a regular user?
The ping binary has setuid bit,
ls -l /bin/ping
-rwsr-xr-x 1 root root 64424 jun 28 2019 /bin/ping
Running ...
- 1
0
votes
2
answers
684
views
How to explain all details with 'ls' command on freebsd and what color means?
I am trying to clone directory with cp command and meeting some attributes lost. For example, when I am trying to run sudo command from copied tree, it gives error.
sudo: /usr/bin/sudo must be owned ...
- 3,195
0
votes
1
answer
63
views
Why is a find process getting started by checksecurity in Debian and how to disable it if it's not useful?
With sudo lsof | grep mounted-drive-name I found that a find process is running on one of my hard drives which I'd like to spare.
With KDE's system monitor it shows me that it was started by anacron-&...
- 4,068
2
votes
2
answers
227
views
What does `ln /path/to/file -i` do in a setuid'ed script?
I was making a Bash script with the setuid permission on, but it didn't work. So I found my solution here:
Why does setuid not work? and
Allow setuid on shell scripts
Now my script works fine and ...
- 209
0
votes
0
answers
35
views
setuid not allowing me to run script as root? [duplicate]
I wrote this tiny script:
#!/usr/bin/env -S bash -xeuo pipefail
whoami
cd /repo && git fetch origin master && git merge -s recursive -X theirs origin/master
And set the u+s bit which ...
- 893
0
votes
0
answers
25
views
setuid doesn't work in /tmp [duplicate]
I wrote a C program, expecting to see the difference between uid and euid with setuid bit enabled:
#include <unistd.h>
#include <stdio.h>
int
main(void) {
printf("euid: %d\n"...
- 914
1
vote
1
answer
539
views
Allow file read only through application
I have a file with a secret and a generator application that reads it and generates something similar to a license.
There are users on that Linux machine who are allow to use that application.
Because ...
- 709
5
votes
1
answer
5k
views
Why ping works without capability and setuid [duplicate]
I learned from here that there's 2 ways to control privileged activities: setuid and capability.
But when I'm playing around with ping on my machine, it seems that it can bypass these 2 mechanism.
...
- 175
0
votes
1
answer
497
views
How to access/set other user's environment variables after setregid() and setreuid() in C
I have a privileged C program that is executed by a standard user (say stduser) and on execution switches to a system user (say sysuser) as follows. Basically, I am trying to do something similar to ...
- 141
2
votes
1
answer
3k
views
what is utempter, and why does xterm want to use it?
when I start xterm, it tries to start a binary:
/usr/lib/x86_64-linux-gnu/utempter/utempter
I could not find any info as to what this binary is for.
man utempter has no entry, and searching the web ...
0
votes
1
answer
117
views
How can I tell if a SRPM package will have components which will run as root?
Some packages install software which needs to run with root privileges, such as the sudo package. Others, such as vim, do not inherently need to run with root privileges.
Is there a generic way to ...
- 384
1
vote
0
answers
96
views
setuid not working as expected in Pop!_OS
So I was trying to experiment with setuid. As per my understanding it allows users to run the binary with context of the owner.
So I wrote a program in C which does write operation in /root directory ...
- 111
18
votes
2
answers
4k
views
How does ping work on Fedora without setuid and capabilities?
As far as I know, ping needs to create a raw socket (which needs either root access or cap_net_raw capabilities).
From my understanding the trend these last years has been to remove setuid binaries ...
- 309
0
votes
1
answer
755
views
script with suid set but not working! [duplicate]
I have a simple script that runs fine under an app ID (just touches a new file), which I am trying to get to call via my personal ID. Note the target file location is in an area that my personal ID ...
- 103
-1
votes
2
answers
756
views
Which one is safer? sudo dnf update OR su - ; dnf update
Is it safer to do:
$ sudo dnf update [enter user password]
or
$ su - [enter root password]
# dnf update
I always assumed they are the exact same thing, because sudo utilizes setuid-root, so the ...
- 135
0
votes
1
answer
338
views
Common binaries with support for command execution, like `awk` and `vim`, not respecting setuid bit?
I'm hardening a Linux system and wanted to test (setuid-based) shell escapes using common binaries, like awk, vim, etc., supporting command executing.
However, all binaries I've tested except sh and ...
- 4,073
0
votes
1
answer
337
views
How do I make sure sudo is setuid in repackaged squashfs?
I'm trying to manipulate a squashfs file, containing a yocto build and an application payload, but everytime I do so, sudo fails to execute afterwards. root user is disabled, so I have no real ...
- 101
0
votes
0
answers
138
views
How can a malicious seccomp filter cause an attempt to use `setuid(2)` to return 0, without actually making the system call?
I was reading the documentation on seccomp(2) on my Debian system, and stumbled upon the following sentence from the paragraph below:
Such a malicious filter might, for example, cause an ...
- 4,073
0
votes
0
answers
91
views
Can the process read the file? SetUID privilege collision
User A executes a setuid program owned by user B. the program wants to read a file in /etc/data, that is only readable by A and no one else. Can the program read the file?
And then I have another ...
- 1
2
votes
1
answer
939
views
setuid not working [duplicate]
I was trying to learn how setuid works.
So I made a dummy program which just prints the current user:
#include<bits/stdc++.h>
using namespace std;
int main(){
cout << system("id -...
0
votes
1
answer
584
views
Normal user run Qt C++ program as root without sudo?
I am writing a robotics program in C++, using Qt for the GUI, where each thread needs access to hardware. The library which accesses the hardware is called pigpio, and it modifies /dev/mem, so it ...
8
votes
1
answer
2k
views
Nano able to read on write-only access file
User has write-only permissions on a file, unable to cat or vi but is able to nano normally. How is this possible?
I was wondering what happens if you only have write-access on a file and this was ...
- 183
0
votes
1
answer
199
views
Why can't I setuid binaries like apt?
During all my education I've been taught that the setuid would allow anyone that has the execution privilege on a file to run it as the owner. However it seems that I'm not able to setuid a binary and ...
- 687
5
votes
2
answers
3k
views
Questions about the saved user ID
As far as I understood the different user IDs are as follows (from the perspective of a process):
real user ID: the user ID that owns the process
effective user ID: the user ID which determines what ...
- 175
3
votes
1
answer
3k
views
Why doesn't setuid() work with non-root users?
I'm experiencing a weird behavior regarding setuid() and the setuid bit.
It seems like the suid bit and setuid() do not work as expected. I am expecting for a binary with +s and owned by uid 1001 ...
- 141
1
vote
1
answer
712
views
How to use the "setuid" bit? [duplicate]
I created a small script as the root user...
#!/bin/bash
cat /etc/shadow
and set the setuid bit and placed it within the guest folder. When I ran the script as guest, it showed permission denied. ...
- 301
0
votes
1
answer
2k
views
Set-UID Capability Leak Attack
I have a C program to demonstrate the capability leak attack regarding set-uid.
// cap_leak.c
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
...
- 211
10
votes
2
answers
2k
views
Why does the setuid bit work inconsistently?
I wrote the code:
// a.c
#include <stdlib.h>
int main () {
system("/bin/sh");
return 0;
}
compiled with command:
gcc a.c -o a.out
added setuid bit on it:
sudo chown root.root a.out
sudo ...
- 103
0
votes
1
answer
51
views
How to Run the command or script through any user in linux? [closed]
I am having a C executable in AIX system by which I can run the command through any user like root or system users. script having below permissions.
On AIX server
lrwsrwxrwx 1 root system 24 ...
- 603
0
votes
2
answers
1k
views
How to resolve sudo error in RHEL7
I am not able to use sudo, how to resolve this ?
$ sudo vi /etc/fstab
sudo: effective uid is not 0, is sudo installed setuid root?
- 89
1
vote
0
answers
287
views
Applying special permission suid & sgid
I was in the processs of learning a bit about the special permission in Linux. Where is find certain anomilies.
suid - For executable/files where user subsume the UID/permission of the owner. With ...
- 111
2
votes
0
answers
432
views
seteuid fails even when all UIDs are 0
I have some C++ code on a Linux machine whose purpose is to run some code as an arbitrary user.
#include <sys/capability.h>
#include <unistd.h>
void doAsUser(uid_t uid) {
if (...
- 21
2
votes
1
answer
274
views
ID inheritance – Which IDs?
I'm learning UNIX file permissions / ID inheritance and would like to clarify something:
I have this list of permissions, users, groups and files:
-rwxr-xr-x userA A foo
-rw-rwsr-x userB B bar
...
2
votes
2
answers
727
views
suid executable not elevating permissions but `sudo` does elevate
I'm trying to write a program that will quickly shut down a laptop without prompting for a password or confirmation. The laptop is running Linux, specifically Manjaro.
To that end, I'm trying to make ...
- 3,016