Questions tagged [setuid]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
183
votes
8answers
138k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
51
votes
2answers
130k views

What does the 's' attribute in file permissions mean? [duplicate]

Please compare the following two lines: -rws---r-x 1 root root 21872 2009-10-13 21:06 prg1 -rwx---r-x 1 root root 21872 2009-10-13 21:06 prg2 Does the setuid bit on prg1, along with the read and ...
45
votes
2answers
48k views

Using the setuid bit properly

I have a process that needs root privileges when run by a normal user. Apparently I can use the "setuid bit" to accomplish this. What is the proper way of doing this on a POSIX system? Also, how ...
35
votes
6answers
3k views

What is the safest way for programmatically writing to a file with root privileges?

A huge application needs, at one specific time, to perform a small number of writes to a file which requires root permissions. It is not really a file but a hardware interface which is exposed to ...
26
votes
1answer
1k views

What would be the best way to work around this glibc problem?

I administer a Gentoo Hardened box that uses file capabilities to eliminate most of the need for setuid-root binaries (e.g. /bin/ping has CAP_NET_RAW, etc). Infact, the only binary I have left is ...
24
votes
1answer
28k views

Difference between owner/root and RUID/EUID

I am relatively new to the concepts mentioned in the question and reading about them from different sources only makes them more confusing. So this is what I understood so far: When we are given ...
16
votes
2answers
16k views

Can gdb debug suid root programs?

I wrote a program that calls setuid(0) and execve("/bin/bash",NULL,NULL). Then I did chown root:root a.out && chmod +s a.out When I execute ./a.out I get a root shell. However when I do gdb ...
15
votes
1answer
18k views

Why does setuid not work? [duplicate]

I want to ensure that my program can only be run by user xyz using root privilege. To do this, I set the setuid bit with: chmod u+s program1.sh ls -l program1.sh rwsr-x--- 1 root house 1299 May 15 23:...
13
votes
3answers
45k views

What does GID mean?

What does GID actually mean? I have Googled it and this is what linux.about.com said: Group identification number for the process. Valid group numbers are given in /etc/group, and in the GID field ...
13
votes
2answers
16k views

Setuid bit seems to have no effect on bash

I was experimenting a bit and noticed something strange: setting the setuid bit on a copy of bash located at /usr/bin/bash-test seemed to have no effect. When I ran an instance of bash-test, my home ...
13
votes
1answer
4k views

root owned program with setuid bit on

Ping is a a program owned by root with the user id bit set. $ ls -l `which ping` -rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping As I understand it, if a user runs the ping process, then the ...
12
votes
5answers
12k views

How do I drop root privileges in shell scripts?

The "--up" option in OpenVPN is normally used for routing etc. And so it is processed before OpenVPN drops root privileges to run as nobody. However, I am invoking shell scripts that need to run as an ...
11
votes
3answers
21k views

How does the set-user-ID mechanism work in Unix?

Can someone please explain the set-user-ID mechanism in Unix ? What was the rationale behind this design decision? How is it different from effective user id mechanism ?
11
votes
4answers
13k views

How do real and effective user IDs work?

When a normal user wants to make change to the passwd file, the user will by setuid be given the effective user access. User becomes root temporarily and can edit passwd. However you can only edit ...
10
votes
2answers
4k views

Group memberships and setuid/setgid processes

Processes which de-escalate privileges via setuid() and setgid() do not seem to inherit the group memberships of the uid/gid they set. I have a server process that must be executed as root in order ...
9
votes
3answers
545 views

Set-uid executable and resulting process user [duplicate]

In Ubuntu 14.04, the passwd executable is -rwsr-xr-x 1 root root 47032 gen 27 01:50 /usr/bin/passwd and the ping executable is -rwsr-xr-x 1 root root 44168 mag 7 2014 /bin/ping so (for both) the ...
9
votes
2answers
8k views

Why setuid does not work on executable?

I know that enabling setuid on scripts has security issues and so is inactive by default, but expect that it works for executables. I created and executable which shows uid as an output following ...
8
votes
4answers
4k views

Which user's password does `sudo` asks for?

$ ls -l /usr/bin/sudo -rwsr-xr-x 1 root root 136808 Jul 4 2017 /usr/bin/sudo so sudo is runnable by any user, and any user who runs sudo will have root as the effective user ID of the process ...
8
votes
2answers
714 views

Why does the setuid bit work inconsistently?

I wrote the code: // a.c #include <stdlib.h> int main () { system("/bin/sh"); return 0; } compiled with command: gcc a.c -o a.out added setuid bit on it: sudo chown root.root a.out sudo ...
8
votes
4answers
1k views

Howto prevent chgrp from clearing “setuid bit”?

We have RH based Linux images; on which I have to "apply" some "special archive" in order to upgrade them to the latest development version of our product. The person creating the archive figured ...
8
votes
1answer
4k views

Why does ping need setuid permission? [duplicate]

I'm looking at a handful of files on my system with setuid permission on my system, by running: sudo find / -perm -4000 I noticed that /bin/ping shows up on the list. Can anyone explain why ping ...
7
votes
3answers
4k views

SetUID bit not working in Ubuntu?

I suppose an executable file with SetUID bit set should be running as its owner but I cannot really reproduce it. I tried the following. $ cat prepare.sh cp /bin/bash . chown root.root bash chmod ...
7
votes
2answers
2k views

Running setuid binary temporarily without setuid?

Currently setting up xpra, which wants to run an X instance as non-root using the dummy driver, but the system Xorg binary is SUID. Since the system auto-updates, I would prefer not making and ...
7
votes
1answer
268 views

Root privileges can be restored after setuid(1000) in musl libc

musl libc allows you to change uid to root even after supposedly dropping permissions with setuid(1000). I am not able to reproduce the problem with glibc. Code: #define _GNU_SOURCE #include <...
6
votes
3answers
1k views

What exactly differentiates the root user from every other user?

What are the fundamental differences between some arbitrary account and root? Is it just the UID being something other than zero? So, what exactly does the su binary do and how does it elevate a user ...
6
votes
3answers
12k views

File permission with setuid and octal 4000

When we set setuid to a file, we do the following in the terminal: chmod u+s filename This works fine. But the octal number 4000 is always associated with setuid (in books etc). I understand (to ...
6
votes
3answers
1k views

Under what scenarios would I want to set a SUID bit?

I'm struggling to wrap my mind around the concept of SUID bits and why they're would be useful. For example, let's say I have a program: -rwsr-xr-x 1 root root 12364 Jan 12 2013 /usr/bin/...
6
votes
2answers
4k views

Purpose of using setuid() in SUID programs

I wonder that an SUID program like passwd is using the setuid() function call. Why does it drop root privileges? Against what types of attack does this help? Buffer-overflow?
6
votes
1answer
590 views

How do I run a process that wants to become root from a systemd service which is a regular user?

I have a service that I start using systemd. The service user and group are changed to a non-privileged user. [Service] ... User=regular_user Group=regular_user ... At some point the service needs ...
6
votes
1answer
2k views

No output from locate command

I usually find the answers to all my Unix related problems already posted as questions and answers. However, this particular issue has had me stumped for the past hour so I thought I’d ask my first ...
6
votes
3answers
4k views

Changing the UID of files in /proc

In a follow up to this question about changing the UID of a user, it is recommended to change the ownership of all files on the system (this answer) find / -uid 1000 -exec chown 5000 '{}' \+ where ...
6
votes
1answer
306 views

suid-root doesn't have effect

A program from apue. #include "apue.h" #include <fcntl.h> int main(int argc, char *argv[]) { if(argc!=2) err_quit("usage: a.out <pathname>"); if(access(argv[1], R_OK)<...
6
votes
1answer
262 views

How does sudo work (besides setuid)?

sudo is elevated to root upon launch because it's binary has a setuid enabled. But when I give /bin/login the exact privileges sudo has, and I try to run it from a user that isn't root, I get the ...
6
votes
1answer
837 views

How does having /dev/fd make running shell scripts under sudo safe?

At the end of the man page for sudo, there's the following remark: Running shell scripts via sudo can expose the same kernel bugs that make setuid shell scripts unsafe on some operating systems ...
6
votes
2answers
3k views

Why is mount.cifs not installed suid by default?

I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that mount....
6
votes
1answer
498 views

Does the noexec mount option imply nosuid?

Many guides on the internet recommend setting the nosuid and noexec options, for example on the /tmp mount point. But doesn't noexec imply nosuid? What cannot get executed cannot make use of the suid ...
6
votes
1answer
567 views

Why doesn't Ubuntu use capabilities on ping?

After running, $ ls -l /bin/ping -rwsr-xr-x 1 root root 34740 Nov 5 2012 /bin/ping I wonder, why doesn't Ubuntu use capabilities (i.e. raw sockets) rather than setuid?
5
votes
1answer
3k views

How to replace setuid with file-system capabilities

Inspired by this question here is the follow-up: As some of you may know setuid-binaries are dangerous, since some exploits use these to escalate their rights up to root. Now it seems that there has ...
5
votes
2answers
4k views

setuid and setgid confusion

I'm trying to fully grasp the concept of setuid and setgid, and I'm not quite sure in what way permissions are actually elevated. Let me provide an example: Users userA (groups: userA groupA) userB (...
5
votes
1answer
3k views

Using setuid Properly

I've been scared too much by the warning about setuid. However I cannot find a way around using it. I want to be able to run: arp -s 198.51.100.1 00:53:00:12:34:56 as the user steven but arp -s ...
4
votes
1answer
3k views

Environment settings on setuid executables

I am observing a curious behavior when running a program with setuid bit enabled. Program foo is owned by user bar with setuid bit set. User execbar runs foo foo reports that one of the dynamic ...
4
votes
3answers
5k views

what is the purpose of setuid enabled with no executable bit?

I am trying to understand permissions in detail. I was reading about setuid and it's uses. However, this particular case confuses me. I have made a small script and now I have set the suid bit for ...
4
votes
1answer
414 views

Why I can not drop sudo root privileges?

I am debugging a program and not quite sure why I can not drop privileges. I have root permissions via sudo and I can call setgid/setuid, but the operation [is] is not supported. Basic code to ...
4
votes
1answer
2k views

How to let a user execute a script owned by root? Setuid doesn't seem to work anymore [duplicate]

I have some bash scripts that I use with the user 'root' to manage iptable rules. The problem is that I want these things at the same time: The script must be owned by root Permissions must be 700 I ...
4
votes
1answer
1k views

Clear setuid permission using numeric mode

On an Ubuntu Linux I have a directory with the setuid bit set (drwsr-xr-x) which I want to unset. Neither chmod 755 nor chmod 0755 nor chmod 00755 (I though maybe the first 0 is interpreted as just "...
4
votes
1answer
754 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
4
votes
1answer
1k views

SUID-bit not working for executables within /tmp directory

Printing the value of getuid() and geteuid() from an executable with SUID-bit (chmod +s) turned-on, seems to result with the original caller ID instead of the owner id if the executable is located ...
4
votes
1answer
100 views

How can I tweak unix settings for 360 Spatial Workstation (specifically the vst and aax audio plugins) to make it run as a non-administrator?

There are free vst and aax (Pro Tools) plugins installed as part of 360 Spatial Workstation. These are greyed-out (as if requiring a license), or invisible (VSTs e.g. in Ableton Live). If you login ...
4
votes
2answers
1k views

using SUID bit to drop privileges

So this is a description of the system I'm working on : a "manager" process spawns all the other applications. The manager application runs as root user. so now, any process that it spawns also ...
4
votes
2answers
740 views

linux setuid does not work

I am learning linux suid,so I have written a small c program with the following content to test it #include<stdio.h> int main(){ system("echo 100 >> test.txt"); return 0; } -rwsr-xr-x 1 ...