Sponsored Content
Operating Systems AIX Why /bin/su permission with SUID? Post 302910427 by Corona688 on Thursday 24th of July 2014 11:36:00 AM
Old 07-24-2014
Permit me to be quite extremely blunt. Your auditor is an idiot. He has heard that "SUID is bad" and parroted it, but has no real understanding of it. Following his advice will ruin your machine.

su couldn't possibly work if it weren't SUID. It needs to access the shadow files, which are locked to root!

Now, if there are things which are set SUID but shouldn't be, that would be bad. Having cp set SUID would be a recipe for disaster for example.
These 3 Users Gave Thanks to Corona688 For This Post:
 

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

/bin/sh: bad interpreter: Permission denied

today i started the LFS book (version 4.0). Basically i am using slackware 9.0 to try and install a new linux completely from source on another partition. Now i took the book's recommendations and created a user called lfs so i wouldn't have to do the stuff as root, and i have got the new LFS... (4 Replies)
Discussion started by: Calum
4 Replies

2. UNIX for Dummies Questions & Answers

fuser: difference with bin/sh and bin/ksh shell script

Hi, I have a problem I don't understand with fuser. I launch a simple shell script mysleep.sh: I launch the command fuser -fu mysleep.sh but fuser doesn't return anything excepted: mysleep: Then I modify my script switching from #!/bin/sh to #!/bin/ksh I launch the command fuser -fu... (4 Replies)
Discussion started by: Peuj
4 Replies

3. Solaris

/usr/bin has been changed with 777 permission

Hello Guruz, Relay bad condition :mad: Some has changed the permission to 777 recursively for /usr/bin directory by mistake. Now all the permission looks to be 777 on /usr/bin Hence I am so many system related errors as 1 show below. When I am trying to change the password, I am getting... (5 Replies)
Discussion started by: bullz26
5 Replies

4. OS X (Apple)

I accidentally changed to only write permission on /usr/bin... please Help!

I accidentally changed to sudo chmod a=w to my /usr/bin folder on my macbook with OS 10.5.8... Please help! I can't even get into a terminal correctly cause it displays: -bash: uname: command not found -bash: cut: command not found -bash: uname: command not found -bash: cut: command not found... (6 Replies)
Discussion started by: scaryMac23
6 Replies

5. Red Hat

/bin strange permission, corrupted? [solved]

Hi I think my /bin is corrupted which is why I can’t boot my server.. Anyone knows what below file permission means? # ls -l /mnt/sysimage | grep bin drwxr-xr-x 2 root root 12288 Sep 29 11:23 sbin ?r--rw-x 41112 16694 1305152 0 Feb 10 2055 bin Tried overwriting, deleting,chmod,chown but... (0 Replies)
Discussion started by: halacil
0 Replies

6. OS X (Apple)

When to use /Users/m/bin instead of /usr/local/bin (& whats the diff?)?

Q1. I understand that /usr/local/bin means I can install/uninstall stuff in here and have any chance of messing up my original system files or effecting any other users. I created this directory myself. But what about the directory I didn't create, namely /Users/m/bin? How is that directory... (1 Reply)
Discussion started by: michellepace
1 Replies

7. Shell Programming and Scripting

[Solved] Retrieve all the permission of the /bin folder

hello friends, By mistake I have run find / -type f -exec chmod 644 {} \; now all permission has been chaged of /bin I am not able to change the permission. I am working on the virtuozzo VPS. Is their any way to retrieve the permission to 770 to /bin Note /bin/chmod also not executing... (2 Replies)
Discussion started by: sharlin
2 Replies

8. AIX

Redistribution bin required for AIX. j7r164redist.7.1.0.25.bin

Hi, I am planning to install a version of Informatica on my AIX box. It requires a specific java build in pap6470_27sr2-20141101_01(SR2). The current link for IBM 64-bit SDK for AIX®, JavaTM Technology Edition, Version 7 Release 1 has a more recent version in j7r164redist.7.1.0.75.bin. Is... (4 Replies)
Discussion started by: meetpraveens
4 Replies

9. UNIX for Dummies Questions & Answers

Difference between inbuilt suid programs and user defined root suid programs under bash shell?

Hey guys, Suppose i run passwd via bash shell. It is a suid program, which temporarily runs as root(owner) and modifies the user entries. However, when i write a C file and give 4755 permission and root ownership to the 'a.out' file , it doesn't run as root in bash shell. I verified this by... (2 Replies)
Discussion started by: syncmaster
2 Replies

10. Shell Programming and Scripting

Usage of #!/bin/sh vs #!/bin/bash shell scripts?

Some question about the usage of shell scripts: 1.) Are the commands of the base shell scripts a subset of bash commands? 2.) Assume I got a long, long script WITHOUT the first line. How can I find out if the script was originally designed für "sh" or "bash"? 3.) How can I check a given... (3 Replies)
Discussion started by: pstein
3 Replies
EXECVE(2)						     Linux Programmer's Manual							 EXECVE(2)

NAME
execve - execute program SYNOPSIS
#include <unistd.h> int execve(const char *filename, char *const argv [], char *const envp[]); DESCRIPTION
execve() executes the program pointed to by filename. filename must be either a binary executable, or a script starting with a line of the form "#! interpreter [arg]". In the latter case, the interpreter must be a valid pathname for an executable which is not itself a script, which will be invoked as interpreter [arg] filename. argv is an array of argument strings passed to the new program. envp is an array of strings, conventionally of the form key=value, which are passed as environment to the new program. Both, argv and envp must be terminated by a null pointer. The argument vector and environ- ment can be accessed by the called program's main function, when it is defined as int main(int argc, char *argv[], char *envp[]). execve() does not return on success, and the text, data, bss, and stack of the calling process are overwritten by that of the program loaded. The program invoked inherits the calling process's PID, and any open file descriptors that are not set to close on exec. Signals pending on the calling process are cleared. Any signals set to be caught by the calling process are reset to their default behaviour. The SIGCHLD signal (when set to SIG_IGN) may or may not be reset to SIG_DFL. If the current program is being ptraced, a SIGTRAP is sent to it after a successful execve(). If the set-uid bit is set on the program file pointed to by filename the effective user ID of the calling process is changed to that of the owner of the program file. Similarly, when the set-gid bit of the program file is set the effective group ID of the calling process is set to the group of the program file. If the executable is an a.out dynamically-linked binary executable containing shared-library stubs, the Linux dynamic linker ld.so(8) is called at the start of execution to bring needed shared libraries into core and link the executable with them. If the executable is a dynamically-linked ELF executable, the interpreter named in the PT_INTERP segment is used to load the needed shared libraries. This interpreter is typically /lib/ld-linux.so.1 for binaries linked with the Linux libc version 5, or /lib/ld-linux.so.2 for binaries linked with the GNU libc version 2. RETURN VALUE
On success, execve() does not return, on error -1 is returned, and errno is set appropriately. ERRORS
EACCES The file or a script interpreter is not a regular file. EACCES Execute permission is denied for the file or a script or ELF interpreter. EACCES The file system is mounted noexec. EPERM The file system is mounted nosuid, the user is not the superuser, and the file has an SUID or SGID bit set. EPERM The process is being traced, the user is not the superuser and the file has an SUID or SGID bit set. E2BIG The argument list is too big. ENOEXEC An executable is not in a recognised format, is for the wrong architecture, or has some other format error that means it cannot be executed. EFAULT filename points outside your accessible address space. ENAMETOOLONG filename is too long. ENOENT The file filename or a script or ELF interpreter does not exist, or a shared library needed for file or interpreter cannot be found. ENOMEM Insufficient kernel memory was available. ENOTDIR A component of the path prefix of filename or a script or ELF interpreter is not a directory. EACCES Search permission is denied on a component of the path prefix of filename or the name of a script interpreter. ELOOP Too many symbolic links were encountered in resolving filename or the name of a script or ELF interpreter. ETXTBSY Executable was open for writing by one or more processes. EIO An I/O error occurred. ENFILE The limit on the total number of files open on the system has been reached. EMFILE The process has the maximum number of files open. EINVAL An ELF executable had more than one PT_INTERP segment (i.e., tried to name more than one interpreter). EISDIR An ELF interpreter was a directory. ELIBBAD An ELF interpreter was not in a recognised format. CONFORMING TO
SVr4, SVID, X/OPEN, BSD 4.3. POSIX does not document the #! behavior but is otherwise compatible. SVr4 documents additional error condi- tions EAGAIN, EINTR, ELIBACC, ENOLINK, EMULTIHOP; POSIX does not document ETXTBSY, EPERM, EFAULT, ELOOP, EIO, ENFILE, EMFILE, EINVAL, EIS- DIR or ELIBBAD error conditions. NOTES
SUID and SGID processes can not be ptrace()d. Linux ignores the SUID and SGID bits on scripts. The result of mounting a filesystem nosuid vary between Linux kernel versions: some will refuse execution of SUID/SGID executables when this would give the user powers she did not have already (and return EPERM), some will just ignore the SUID/SGID bits and exec success- fully. A maximum line length of 127 characters is allowed for the first line in a #! executable shell script. SEE ALSO
chmod(2), fork(2), execl(3), environ(5), ld.so(8) Linux 2.0.30 1997-09-03 EXECVE(2)
All times are GMT -4. The time now is 10:18 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy