Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
36 votes
Accepted

Why it is possible for normal users to power off computer?

This is alluded to in a comment on Why does reboot and poweroff require root privileges? On some distributions using systemd, poweroff is now a symlink to systemctl, which instructs systemd to shut ...
Stephen Kitt's user avatar
34 votes

What determines which Linux commands require root access?

It's mainly a matter of what the tool or program does. Keeping in mind that a non-superuser can only touch files that it owns or has access to, any tool that needs to be able to get its fingers into ...
DopeGhoti's user avatar
  • 76.4k
33 votes
Accepted

What is the safest way for programmatically writing to a file with root privileges?

You don't need to give sudo access to echo. In fact, that's pointless because, e.g. with sudo echo foo > bar, the redirection is done as the original user, not as root. Call the small script with ...
cas's user avatar
  • 78.9k
27 votes

How do I drop root privileges in shell scripts?

Covering only runit and sudo misses a lot. There is actually a whole family of toolsets like runit, and a wide choice of tools for doing exactly this, the very task that they were designed for: ...
JdeBP's user avatar
  • 69.1k
24 votes
Accepted

make all the processes of a given user killable by anyone

Give the other users permission to kill the processes as the low priority user through sudo -u lowpriouser /bin/kill PID A user can only signal their own processes, unless they have root privileges. ...
Kusalananda's user avatar
  • 336k
18 votes
Accepted

Is it possible to run 'unshare -n [program]' as an unprivileged user?

In later versions of util-linux, unshare gained the --map-root-user option. Quoting from unshare(1) version 2.26.2: -r, --map-root-user Run the program only after the current effective user and ...
Amir's user avatar
  • 1,681
16 votes

What is the safest way for programmatically writing to a file with root privileges?

Check the owner on the gpio files: ls -l /sys/class/gpio/ Most likely, you'll find out that they are owned by group gpio: -rwxrwx--- 1 root gpio 4096 Mar 8 10:50 export ... In that case, ...
jpa's user avatar
  • 1,269
16 votes
Accepted

Vulnerability demonstration on Ubuntu 9.04

The 9.04 release was supported until October 23 2010. The vulnerability you found was reported in August 2009. It seems reasonable that, since the release was still current and supported at the time, ...
terdon's user avatar
  • 243k
16 votes
Accepted

What determines which Linux commands require root access?

In linux, the privileges of root were at one point divided into "capabilities", so you can get a full listing of root's special privileges by looking into that documentation: man 7 capabilities. To ...
JoL's user avatar
  • 4,775
10 votes
Accepted

Why does the setuid bit work inconsistently?

What changed is that /bin/sh either became bash or stayed dash which got an additional flag -p mimicking bash's behaviour. Bash requires the -p flag to not drop setuid privilege as explained in its ...
A.B's user avatar
  • 36.9k
9 votes

Does managing cgroups require root access?

The normal scenario is that you set cgcreate, cgset, cgdelete, cgget, etc. up as root. Eventually the program/script meant to be restrained from sucking to many resources will be executed as a normal ...
oceansailor's user avatar
9 votes

Allowing a regular user to listen to a port below 1024

If the service is run by systemd, set the desired port in the service configuration open the unit file (usually /etc/systemd/system/something.service), go to the [Service] section, add a new line ...
Martin's user avatar
  • 203
9 votes
Accepted

Is it my job as a Linux admin to drop root privileges of applications, or the application developers job?

As a Linux admin, is one of my jobs to carry out some sort of task to drop root privileges of the applications running on my systems? Yes. It is your job make sure it is done. If the application ...
DepressedDaniel's user avatar
9 votes
Accepted

How to find what ring a process is running on in Linux?

On x86, the current privilege level is determined by the bottom two bits of the code segment selector, i.e. the value stored in the CS register. So "all" you need to do to determine the current ...
Stephen Kitt's user avatar
8 votes

How do I drop root privileges in shell scripts?

On Linux-based systems you can setpriv (from util-linux): setpriv --reuid=1000 --regid=1000 --init-groups COMMAND [ARGUMENTS...] # Like su/runuser/sudo setpriv --reuid=1000 --regid=1000 --clear-...
dcoles's user avatar
  • 341
8 votes

Why does the setuid bit work inconsistently?

Probably the shell is changing its effective user ID back to the real user ID as part of its startup for some reason or another. You could verify this by adding: /* needs _GNU_SOURCE; non-Linux users ...
derobert's user avatar
  • 110k
8 votes
Accepted

Super-user privileges for Chromium browser

BTW : where the flag F value 5 means used super-user privileges according to man ps. Indeed but not only : 5 = 1 + 4 PROCESS FLAGS The sum of these values is displayed in the "F" column, ...
MC68020's user avatar
  • 8,211
7 votes

What is the safest way for programmatically writing to a file with root privileges?

One solution for this (used particularly on the Linux desktop but also applicable in other cases) is to use D-Bus to activate a small service running as root and polkit to do the authorization. This ...
mattdm's user avatar
  • 40.3k
7 votes
Accepted

setuid root does not work

If you change the code like this you can see the effective and real UIDs: #include <string> #include <stdlib.h> int main(int argc, char *argv[]){ system("id"); system("...
Chris Davies's user avatar
6 votes
Accepted

How can a file manager mount a drive without root?

Users operating at the console of a graphical workstation have noted that several programs can be executed without apparently needing root authentication nor a password such as reboot. This process ...
mdpc's user avatar
  • 6,884
6 votes
Accepted

Get Current Privilege Level for a process (ring)

On x86, there’s no real need for another way to figure out which ring a process is running in, because the CS register fully determines the active ring. Since you’re running VMs, depending on which ...
Stephen Kitt's user avatar
6 votes
Accepted

What are the daemon user and group for?

They are legacy thing ; daemon user & group are respectively unprivileged meant to be used by multiple applications to get restricted access to the system. Now days you should use a dedicated user ...
Reda Salih's user avatar
  • 1,754
6 votes

sudo -l privilege escalation

From the sudoers man page: If, however, the env_reset option is disabled, any variables not explicitly denied by the env_check and env_delete options are inherited from the invoking process. So, you ...
ilkkachu's user avatar
  • 140k
5 votes
Accepted

Launch a sudoed command upon script termination?

I notice that you're doing a lot of switching back and forth between the regular user and root: switch to root to run unshare switch back to the normal user to run bash (although it seems like you ...
Celada's user avatar
  • 44.3k
5 votes

What is the safest way for programmatically writing to a file with root privileges?

One way to do this is to make a setuid-root program written in C that does only what's needed and nothing more. In your case, it doesn't have to look at any user input at all. #include <unistd.h&...
Peter Cordes's user avatar
  • 6,466
5 votes
Accepted

Executing commands in an elevated bash process by writing to the standard input of its parent script process

This is normal. To understand it, let's see how file descriptors work and how they are passed between processes. You mentioned that you are using GLib.spawn_async() to spawn the shell script. That ...
marcan's user avatar
  • 968
5 votes
Accepted

How to understand Bash privileged mode?

Privileged mode exists to try to increase security (by restricting potentially dangerous actions) when the shell is running under augmented privileges, such as invoked by a setuid program. Yes, you ...
filbranden's user avatar
  • 21.8k
5 votes

make all the processes of a given user killable by anyone

You shouldn't kill the processes, if they're low priority they'll consume few resources. To actually make them low priority, either change their priority manually, or use a daemon like autonice that ...
Alnitak's user avatar
  • 271
5 votes
Accepted

Failed to mount "partition name" - "Not authorized to perform operation" - in Xfce Debian

Turns out, the dialog window that asks for a password is actually a separate program called "PolicyKit authentication agent" which for some reason wasn't installed. So i installed policykit-1-gnome ...
skogach's user avatar
  • 71

Only top scored, non community-wiki answers of a minimum length are eligible