[SOLVED] suid & guid

Soji Antony · 05-18-2011, 09:13 AM

Hi

Does linux kernel 2.6 support suid & guid?.

I just read somewhere that "latest linux kernels does not support suid & guid as it can pose a security risk if the setuid attribute is assigned to executable programs that are not carefully designed".

I need a confirmation about what I say is correct or if not please correct me.

Thanks in advance ....

Mr. Alex · 05-18-2011, 09:22 AM

I use SUID, it works with my 2.6.38.4. And no, they can't remove this function from the kernel, it's not Windows.

vikas027 · 05-18-2011, 09:42 AM

Quote:

Originally Posted by Soji Antony

Hi

Does linux kernel 2.6 support suid & guid?.

I just read somewhere that "latest linux kernels does not support suid & guid as it can pose a security risk if the setuid attribute is assigned to executable programs that are not carefully designed".

I need a confirmation about what I say is correct or if not please correct me.

Thanks in advance ....

I do not think so. If you are talking about Linux systems, it does have SUID bit set on passwd command , which is essential and cannot be neglected.

Quote:

# ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 23420 Aug 11 2010 /usr/bin/passwd

I am using CENTOS 5.6 and it has has 2.6 kernel.

Code:

# uname -r
2.6.18-238.el5

Soji Antony · 05-19-2011, 12:13 PM

Hi

Thanks for your reply.

Actually, I was trying to write a script which enables normal users to change their route. I wrote a bash script & set SUID, thinking that that script will run with root privilege & users can change their route using following commands.

Code:

route del default 
route add default gw 192.168.0.5

But even though SUID is set, the users get permission denied error. However I managed to solve this problem by calling this bash script from a C compiled program.

Code:

$cat call-script

#include
#include
#include
#include

int main()
{
setuid( 0 );
system( "/path/to/bash-script" );

return 0;
}

Code:

# chmod u+s call-script

Now users can execute ./call-script & can chanage their route with root privilege.
So , I assume that setuid bit is disabled on shell scripts(bash) & can be used only with binary executable. Please correct me If I am wrong ....

Quote:

http://www.tuxation.com/setuid-on-shell-scripts.html

Thanks ...

sundialsvcs · 05-19-2011, 08:31 PM

A couple of things ...

Typical Linux filesystems are a lot more sophisticated than "the handful of attribute bits" might lead you to believe. They often support Access Control Lists (ACLs), and may be capable of doing authentication and authorization in lots of other ways as well. So, yes, it is possible to nullify the effect of the "SetUID" bits.

Linux is fully capable of being "a good corporate citizen" in whatever company (or government) secured network you might be a part of. It maintains "the old Unix ways of doing things" partly just for compatibility and familiarity ... not out of necessity.

chrism01 · 05-20-2011, 01:10 AM

It's true that suid, sgid are not enabled by the kernel for scripting(!) languages; that's not a new thing BTW.
However, if the user can run 'route', it could be set suid if reqd, much like the passwd cmd mentioned.
Usually however, you'd enable just those few users via sudo instead of allowing all users.

Soji Antony · 05-20-2011, 07:48 PM

Thank you all for replying to my questions .....