Do I need to set SUID when I run a script as `sudo`?
Clash Royale CLAN TAG#URR8PPP
up vote
3
down vote
favorite
I need to run a script as root
. The instructions given in the link say that I ought to:
- Set the SETUID bit on the script (i.e.
chmod 4755
). - Run the script as sudo (i.e.
sudo /path/to/thescript.sh
)
From the documentation I'm reading about the SETUID bit, my understanding is that by setting it, whoever runs the script is given the privileges of the owner. So if the owner of the script is root
, then anyone running the script with the SETUID bit on will have the script running with root privileges.
If that's the case, why do I need to do a sudo
before running the script if the SETUID bit is set?
If I need to use sudo
to run the script, why bother setting the SETUID bit. Just as an experiment I ran my script just using sudo
and it was able to do what I needed to do (the script recursively changes permissions on a bunch of files).
permissions sudo setuid
add a comment |Â
up vote
3
down vote
favorite
I need to run a script as root
. The instructions given in the link say that I ought to:
- Set the SETUID bit on the script (i.e.
chmod 4755
). - Run the script as sudo (i.e.
sudo /path/to/thescript.sh
)
From the documentation I'm reading about the SETUID bit, my understanding is that by setting it, whoever runs the script is given the privileges of the owner. So if the owner of the script is root
, then anyone running the script with the SETUID bit on will have the script running with root privileges.
If that's the case, why do I need to do a sudo
before running the script if the SETUID bit is set?
If I need to use sudo
to run the script, why bother setting the SETUID bit. Just as an experiment I ran my script just using sudo
and it was able to do what I needed to do (the script recursively changes permissions on a bunch of files).
permissions sudo setuid
5
Possible duplicate of Using the setuid bit properly
â thecarpy
Nov 18 '17 at 14:35
add a comment |Â
up vote
3
down vote
favorite
up vote
3
down vote
favorite
I need to run a script as root
. The instructions given in the link say that I ought to:
- Set the SETUID bit on the script (i.e.
chmod 4755
). - Run the script as sudo (i.e.
sudo /path/to/thescript.sh
)
From the documentation I'm reading about the SETUID bit, my understanding is that by setting it, whoever runs the script is given the privileges of the owner. So if the owner of the script is root
, then anyone running the script with the SETUID bit on will have the script running with root privileges.
If that's the case, why do I need to do a sudo
before running the script if the SETUID bit is set?
If I need to use sudo
to run the script, why bother setting the SETUID bit. Just as an experiment I ran my script just using sudo
and it was able to do what I needed to do (the script recursively changes permissions on a bunch of files).
permissions sudo setuid
I need to run a script as root
. The instructions given in the link say that I ought to:
- Set the SETUID bit on the script (i.e.
chmod 4755
). - Run the script as sudo (i.e.
sudo /path/to/thescript.sh
)
From the documentation I'm reading about the SETUID bit, my understanding is that by setting it, whoever runs the script is given the privileges of the owner. So if the owner of the script is root
, then anyone running the script with the SETUID bit on will have the script running with root privileges.
If that's the case, why do I need to do a sudo
before running the script if the SETUID bit is set?
If I need to use sudo
to run the script, why bother setting the SETUID bit. Just as an experiment I ran my script just using sudo
and it was able to do what I needed to do (the script recursively changes permissions on a bunch of files).
permissions sudo setuid
edited Nov 19 '17 at 6:42
peterh
3,94592755
3,94592755
asked Nov 18 '17 at 13:35
Avery Chan
3711512
3711512
5
Possible duplicate of Using the setuid bit properly
â thecarpy
Nov 18 '17 at 14:35
add a comment |Â
5
Possible duplicate of Using the setuid bit properly
â thecarpy
Nov 18 '17 at 14:35
5
5
Possible duplicate of Using the setuid bit properly
â thecarpy
Nov 18 '17 at 14:35
Possible duplicate of Using the setuid bit properly
â thecarpy
Nov 18 '17 at 14:35
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
4
down vote
Ok, short answer, never set SETUID root
on a script, ever. Actually, it appears not to work.
Long answer: Never, ever, EVER, set a script SETUID root
, NEVER!
Since this is so braindead, I would stop there NOW.
The guy says This approach might create severe security holes! D'ohhhh! Then why do you answer that ?
You only SETUID root
trusted binary programs that fulfill specific tasks, and even then, be very very cautious!
That being said, what do you want to achieve ?
If you want normal users to be able to run a script with root
privileges, you ensure the script is read-only for all but root
and you add an entry to your /etc/sudoers
file which allows your users to execute that script and that script only.
See man sudoers
for more information.
If you have the name of a group the users belong to and the full path to the script, I can write a /etc/sudoers
rule for you.
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
4
down vote
Ok, short answer, never set SETUID root
on a script, ever. Actually, it appears not to work.
Long answer: Never, ever, EVER, set a script SETUID root
, NEVER!
Since this is so braindead, I would stop there NOW.
The guy says This approach might create severe security holes! D'ohhhh! Then why do you answer that ?
You only SETUID root
trusted binary programs that fulfill specific tasks, and even then, be very very cautious!
That being said, what do you want to achieve ?
If you want normal users to be able to run a script with root
privileges, you ensure the script is read-only for all but root
and you add an entry to your /etc/sudoers
file which allows your users to execute that script and that script only.
See man sudoers
for more information.
If you have the name of a group the users belong to and the full path to the script, I can write a /etc/sudoers
rule for you.
add a comment |Â
up vote
4
down vote
Ok, short answer, never set SETUID root
on a script, ever. Actually, it appears not to work.
Long answer: Never, ever, EVER, set a script SETUID root
, NEVER!
Since this is so braindead, I would stop there NOW.
The guy says This approach might create severe security holes! D'ohhhh! Then why do you answer that ?
You only SETUID root
trusted binary programs that fulfill specific tasks, and even then, be very very cautious!
That being said, what do you want to achieve ?
If you want normal users to be able to run a script with root
privileges, you ensure the script is read-only for all but root
and you add an entry to your /etc/sudoers
file which allows your users to execute that script and that script only.
See man sudoers
for more information.
If you have the name of a group the users belong to and the full path to the script, I can write a /etc/sudoers
rule for you.
add a comment |Â
up vote
4
down vote
up vote
4
down vote
Ok, short answer, never set SETUID root
on a script, ever. Actually, it appears not to work.
Long answer: Never, ever, EVER, set a script SETUID root
, NEVER!
Since this is so braindead, I would stop there NOW.
The guy says This approach might create severe security holes! D'ohhhh! Then why do you answer that ?
You only SETUID root
trusted binary programs that fulfill specific tasks, and even then, be very very cautious!
That being said, what do you want to achieve ?
If you want normal users to be able to run a script with root
privileges, you ensure the script is read-only for all but root
and you add an entry to your /etc/sudoers
file which allows your users to execute that script and that script only.
See man sudoers
for more information.
If you have the name of a group the users belong to and the full path to the script, I can write a /etc/sudoers
rule for you.
Ok, short answer, never set SETUID root
on a script, ever. Actually, it appears not to work.
Long answer: Never, ever, EVER, set a script SETUID root
, NEVER!
Since this is so braindead, I would stop there NOW.
The guy says This approach might create severe security holes! D'ohhhh! Then why do you answer that ?
You only SETUID root
trusted binary programs that fulfill specific tasks, and even then, be very very cautious!
That being said, what do you want to achieve ?
If you want normal users to be able to run a script with root
privileges, you ensure the script is read-only for all but root
and you add an entry to your /etc/sudoers
file which allows your users to execute that script and that script only.
See man sudoers
for more information.
If you have the name of a group the users belong to and the full path to the script, I can write a /etc/sudoers
rule for you.
edited Nov 18 '17 at 14:18
answered Nov 18 '17 at 14:00
thecarpy
2,210824
2,210824
add a comment |Â
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f405432%2fdo-i-need-to-set-suid-when-i-run-a-script-as-sudo%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
5
Possible duplicate of Using the setuid bit properly
â thecarpy
Nov 18 '17 at 14:35