Question: the concept of suid and sgid

feetyouwell · 02-03-2004, 03:08 PM

I have a question about suid and sgid
by setting up suid/sgid, you're running the program with the permission of the owner instead of your permission, one obvious example is passwd, my question is that if you're running passwd as root, then you can only change your own password, why when you do "passwd <someonelese>" it will not work, theorically you're root ????
I also like to know under what circumstances it's good to use suid and sgid, and how would i know what true priviliges that a program will give.

Thanx

kevinatkins · 02-03-2004, 03:19 PM

afaik, my understanding of sticky user & group 'bits' is to allow common access to, for instance, a 'temporary' directory, whereby only the 'owners' of files created in said directory can modifiy or delete those files. that's as far as my limited understanding goes, and it doesn't extend to sticky permissions on files - perhaps with less beer and more time i might be able to figure it out.....

stickman · 02-03-2004, 03:49 PM

The SUID bit allows you to run the program with the privelages of the owner. In the case of passwd, it is necessary because /etc/shadow is readable only by root. If passwd was not SUID, then no user would be able to change their password because there would be no mechanism in place to modify the shadow file. As far as specifying the username as an argument, it is not necessary unless root is trying to change the password of another user.

feetyouwell · 02-03-2004, 03:58 PM

i guess my question is that
if passwd as a program is run by root, then anything ought be done such as passwd <different_user>.
Maybe when you do passwd <different_user>, it sends to another process yet only root has access to????

stickman · 02-03-2004, 04:12 PM

The reason that passwd is SUID to root is because only root can read the shadow file. Regular users can't read the shadow file. In addition, only root can change another user's password.