Is possible to execute command as root when switched from root to user using su?

Question

Same as topic.

I'm root. Then switch to user1 using

su - user1

Then execute command as root without sudo or suid/chmod. Is it possible?

One person probably did this but tells me it's a magic trick...

Add execution permissions to required executable file for target user/group — aepot, Mar 24 '20 at 11:11

score 2 · Answer 1 · answered Mar 24 '20 at 12:22

This is not a huge security problem. The true problem is in how people erroneously think that su works.

su adds privileges to a login session. It does not take existing privileges away, or overlay existing processes, or create new login sessions. One can very simply suspend the child shell and go back to the parent one. Without the - one can even do this with the handy suspend command that is built-in to the C, Z, Korn, and Bourne Again shells. With it, suspension is an only slightly more difficult exercise in the use of the kill utility.

The architecture of dropping privileges is quite different. It involves chain-loading through programs such as setuidgid and not abusing su (or indeed sudo). su (and sudo) is for adding privileges, not dropping them.

Is possible to execute command as root when switched from root to user using su?

1 Answers1

Further reading