4

I need to run a script as root. The instructions given in the link say that I ought to:

  • Set the SETUID bit on the script (i.e. chmod 4755).
  • Run the script as sudo (i.e. sudo /path/to/thescript.sh)

From the documentation I'm reading about the SETUID bit, my understanding is that by setting it, whoever runs the script is given the privileges of the owner. So if the owner of the script is root, then anyone running the script with the SETUID bit on will have the script running with root privileges.

If that's the case, why do I need to do a sudo before running the script if the SETUID bit is set?

If I need to use sudo to run the script, why bother setting the SETUID bit. Just as an experiment I ran my script just using sudo and it was able to do what I needed to do (the script recursively changes permissions on a bunch of files).

peterh
  • 9,731
Son of the Wai-Pan
  • 699

1 Answers1

5

Ok, short answer, never set SETUID root on a script, ever. Actually, it appears not to work.

Long answer: Never, ever, EVER, set a script SETUID root, NEVER!

Since this is so braindead, I would stop there NOW.

The guy says This approach might create severe security holes! D'ohhhh! Then why do you answer that ?

You only SETUID root trusted binary programs that fulfill specific tasks, and even then, be very very cautious!

That being said, what do you want to achieve ?

If you want normal users to be able to run a script with root privileges, you ensure the script is read-only for all but root and you add an entry to your /etc/sudoers file which allows your users to execute that script and that script only.

See man sudoers for more information.

If you have the name of a group the users belong to and the full path to the script, I can write a /etc/sudoers rule for you.

thecarpy
  • 3,935