UNIX for Dummies Questions & Answers

Actually some System V versions allow a user to chown a file even to root. But as the Posix standard says: "If the specified file is a regular file, one or more of the S_IXUSR, S_IXGRP, or S_IXOTH bits of the file mode are set, and the process does not have appropriate privileges, the set-user-ID (S_ISUID) and set-group-ID (S_ISGID) bits of the file mode shall be cleared upon successful return from chown().".

I tried this in the 80's on a System III version. I tried:
cp /bin/sh /tmp/mysu
chmod 4777 /tmp/mysu
chown root /tmp/mysu

Each command worked, but /tmp/mysu only had a mode of 777. I tried several other combos along the same lines but there was no easy way to create a SUID to root executable unless I was root to start.

Hi Perderabo,

Yes, I have seen this behavior, where the suid bit is cleared when the ownership is changed to root (on the few systems that permit changing owner from a non-priv user to root).