[SOLVED] run commands as root.

anon036 · 03-04-2010, 09:18 AM

Hi.

I need to launch a bash file in Linux from an unprivileged user session, file that will run bash commands as root. But I do not want to create an user with root privileges to do that also the process must be silent (no password asked).

How can I do this without adding a user in sudoers and without giving rights to all users to execute the commands from that bash file?

I have tried SUID option witch would had been good as functionality but I understand that SUID doesn't work for script bash files.

Merci
Julia

smoker · 03-04-2010, 09:24 AM

chown root:root bash_file
chmod 755 bash_file

All users will be able to execute the bash_file but not run any separate commands from inside it. But any files created by that script will be owned by root.

If you mean what I think you mean

anon036 · 03-04-2010, 09:40 AM

The sell script will not create, modify or alter any other file. It must be able to run commands like iptables -L

nomb · 03-04-2010, 02:34 PM

Quote:

Originally Posted by julia2009

I have tried SUID option witch would had been good as functionality but I understand that SUID doesn't work for script bash files.

What you can do is call your script from a little c wrapper that is suid root.

Code:

$ cat wrapper.c
int main(void)
{
        system("/bin/bash ./should_run_as_root.sh");
}
$ gcc -o wrapper wrapper.c
$ sudo chown root wrapper
$ sudo chmod ug+s wrapper
$ ll wrapper
-rwsr-sr-x 1 root users 6667 2009-02-17 11:11 wrapper
$

I've used this trick quite a few times.

Source: stackoverflow.com

nomb

GazL · 03-04-2010, 04:14 PM

Quote:

Originally Posted by nomb

What you can do is call your script from a little c wrapper that is suid root.

Code:

$ cat wrapper.c
int main(void)
{
        system("/bin/bash ./should_run_as_root.sh");
}
$ gcc -o wrapper wrapper.c
$ sudo chown root wrapper
$ sudo chmod ug+s wrapper
$ ll wrapper
-rwsr-sr-x 1 root users 6667 2009-02-17 11:11 wrapper
$

I've used this trick quite a few times.

Source: stackoverflow.com

nomb

Oh dear God!.. NOOOOO!

Think what would happen if I as a non privileged user did

Code:

cd evil_directory_containing_evil_should_run_as_root.sh
/path/to/wrapper

If you must do this sort of thing, use absolute filepaths!

You also need to make sure you sanitise important environment variable right at the beginning of the script. PATH and IFS being two key ones, and be very careful about how you code the script.

You'll also need to ensure that only authorised people have execute permission on the wrapper binary.

Web31337 · 03-04-2010, 06:18 PM

Yet another malicious advice.
nomb please don't use root privileges unless you learn the basics.

About that wrapper prog(if you're planning to use that): you will also need to ensure that shell script is owned by root and has 0700 permissions since it's being read and executed as root, no need to make it readable for everyone. And take care of permissions for the directory in which it resides so that noone can remove it and replace with own script.

Valery Reznic · 03-04-2010, 11:57 PM

Quote:

Originally Posted by nomb

What you can do is call your script from a little c wrapper that is suid root.

Code:

$ cat wrapper.c
int main(void)
{
        system("/bin/bash ./should_run_as_root.sh");
}
$ gcc -o wrapper wrapper.c
$ sudo chown root wrapper
$ sudo chmod ug+s wrapper
$ ll wrapper
-rwsr-sr-x 1 root users 6667 2009-02-17 11:11 wrapper
$

I've used this trick quite a few times.

Source: stackoverflow.com

nomb

Don't mind security implication, are you sure it will work at all ?
I think setuid(0) before system() is missing.

And back to security - how having one more suid root executable is better/more convinience than just configuring sudo ?

chrism01 · 03-05-2010, 12:38 AM

I'd like to know why you think sudo would be a problem; its' exactly the sort of issue it was designed to handle...

nomb · 03-05-2010, 09:03 AM

Quote:

Originally Posted by GazL

If you must do this sort of thing, use absolute filepaths!

You are absolutely correct. I was just showing an example of an alternative method and didn't really quality check it as good as I should have. Actually, I just copied the code from the originating source and wouldn't recommend using it verbatim without some modifications but wanted to show the concept. But that is why I showed the source of where that was from in hopes that the OP would go read all the comments.

Quote:

Originally Posted by Web31337

Yet another malicious advice.
nomb please don't use root privileges unless you learn the basics.

I think you need to re-think your apparent definition of "malicious advice". And I find it funny that you think you know how much I know.

Quote:

Originally Posted by Valery Reznic

Don't mind security implication, are you sure it will work at all ?
I think setuid(0) before system() is missing.

Yes again I was just pointing him to an example of an alternative. Meaning the site I sourced to not the code itself. This is probably my worst post ever but I was running really really late and wanted to reply before I forgot, sorry about that guys.

Anyway I was hoping the OP would goto the sourced site and read. The very first comment on that site is:

Quote:

Since the suid bit on executables only changes the effective UID (EUID) the executable will run as, and not the real UID (RUID) which getuid() returns, and in addition to the restriction on suid interpreted scripts (any executable beginning with "#!"), some shells like bash as an extra safety measure will set the EUID back to the RUID in this case, you will need to use the call setuid(0) in the C code before executing the script.

See the man pages of the setuid, seteuid, getuid, and geteuid to learn the exact semantics of the real and effective UIDs.

(WARNING) Of course, this is an appropriate point to mention that the restriction on suid scripts in many Unix systems, shells and interpreters, are there for a reason, which is that if the script is not very careful about sanitizing its input and the state of environment when it is executed, they are dangerous and can be exploited for security escalation. So be very careful when doing this. Set the access to your script and wrapper as strict as you can, only allow this very specific script which you intend to be executed, and clear the environment within your C program before starting the script, setting environment variables such as PATH to contain exactly what is necessary in the right order and no directories that are writable to others.

Quote:

Originally Posted by chrism01

I'd like to know why you think sudo would be a problem; its' exactly the sort of issue it was designed to handle...

Yea I was wondering that myself. Although in all fairness he didn't say sudo would be a problem that I saw, just that he didn't want to add a user into sudo.

And actually to recap is criteria:

Quote:

- launch a script that can run commands as root from an unprivleged user session
- does not want to create a user with root privileges
- run silently, no password asked
- does not want to add a user into sudo
- does not want to give rights to all users to execute the commands from that bash file

My response was more focusing on one particular part of his question.

Quote:

I have tried SUID option witch would had been good as functionality but I understand that SUID doesn't work for script bash files.

But I agree, the best way would be to use sudo. Perhaps the OP would like to explain why he doesn't want to add a user into sudo?

GazL · 03-05-2010, 09:36 AM

Quote:

Originally Posted by nomb

You are absolutely correct. I was just showing an example of an alternative method and didn't really quality check it as good as I should have.

Yep, I guessed as much. From what you posted, it was quite clear that you weren't the original author of that monstrosity,

Web31337 · 03-05-2010, 09:52 AM

I know, you're not the author, nomb, but sorry doesn't take away possible results, so let us just hope no one really used that solution from over here and if someone did, then luckily that code didn't work(because it works on debian even without setuid and setgid calls, probably an author used debian or other similar system supporting that).

nomb · 03-05-2010, 10:22 AM

Quote:

Originally Posted by Web31337

I know, you're not the author, nomb, but sorry doesn't take away possible results, so let us just hope no one really used that solution from over here and if someone did, then luckily that code didn't work(because it works on debian even without setuid and setgid calls, probably an author used debian or other similar system supporting that).

Oh I wasn't apologizing for the code. It wasn't a fabricated ready to use solution. Again it was to point the OP in a possible solution to his problem that suid scripts don't run the contained commands as root; but was up to him to go read through that thread which is why I made sure to include it. I was however apologizing that I didn't read over my post as well as I should have before posting it and put in a line saying that he should go read through the thread before using it in a solution.

On another topic, that is interesting it works in Debian like that. I just tried on RHEL 5 and Arch and they both required the setuid(0) to be in the c code.

anon036 · 03-06-2010, 04:27 AM

Thank you nomb, you first answer is exactly what I was looking for. To be honest I was hoping for a more elegant and simple solution. Nevertheless, it works for me.
Why is it necessary?
Very simple: I have multiple numerous persons logging in as the same unprivileged user. Making a different user on the station for everyone is physically impossible. In the same time they must be able to run as root a very small and quite specific commands like "iptables -L" with a limited predefined number of parameters. They will not have write permissions on the C compiled file. And to answer to those who thinks it's a security risk, I totally disagree, since:
- they will have only execute privileges (cannot write, rename delete the bin file);
- they can run the file with a strict predefined (in form and number) parameters at a strictly controlled time and conditions (the bin file will validate the request from the unprivileged user if a certain file exists, etc);
On the other hand, sudo would be a massive security risk, since they will be able to run all the commands included in my case in the C file, in any order, at their will. Root actually loses any control.

I'm only sorry I cannot do this in a bash file. It would have been easier for me to debug an modify the small scripts....

Julia

anon036 · 03-06-2010, 04:30 AM

Quote:

Originally Posted by nomb

What you can do is call your script from a little c wrapper that is suid root.

Code:

$ cat wrapper.c
int main(void)
{
        system("/bin/bash ./should_run_as_root.sh");
}
$ gcc -o wrapper wrapper.c
$ sudo chown root wrapper
$ sudo chmod ug+s wrapper
$ ll wrapper
-rwsr-sr-x 1 root users 6667 2009-02-17 11:11 wrapper
$

I've used this trick quite a few times.

Source: stackoverflow.com

nomb

Thank you nomb, you first answer is exactly what I was looking for. To be honest I was hoping for a more elegant and simple solution. Nevertheless, it works for me.
Why is it necessary?
Very simple: I have multiple numerous persons logging in as the same unprivileged user. Making a different user on the station for everyone is physically impossible. In the same time they must be able to run as root a very small and quite specific commands like "iptables -L" with a limited predefined number of parameters. They will not have write permissions on the C compiled file. And to answer to those who thinks it's a security risk, I totally disagree, since:
- they will have only execute privileges (cannot write, rename delete the bin file);
- they can run the file with a strict predefined (in form and number) parameters at a strictly controlled time and conditions (the bin file will validate the request from the unprivileged user if a certain file exists, etc);
On the other hand, sudo would be a massive security risk, since they will be able to run all the commands included in my case in the C file, in any order, at their will. Root actually loses any control.

I'm only sorry I cannot do this in a bash file. It would have been easier for me to debug an modify the small scripts....

Julia

nomb · 03-08-2010, 08:32 AM

You're welcome.

nomb