restrict suid and sgid permissions

[unixadmin_1]

The switch user identification (SUID) and switch group identification (SGID) permissions were still used. If an SUID program were to give users unintended write access, the system would be exposed as the SUID program could be replaced by a program with a different function and be used to gain unrestricted access to root. The use of an SGID bit creates a special program, allowing an otherwise restricted user to access certain files in a predetermined way.

[yulianto piyut]

check this site www.cisecurity.org

[Laurent Menase]

is it a question about the Set User ID bit? ( not Switch but Set)

If a non-root user modify a file with SUID bit, SUID bit & SGID (Set Group ID) bit is removed.

[unixadmin_1]

No its not the set switch userid and switch groupid

[Laurent Menase]

man chmod:
s Add or delete the set-owner-ID-on-file-
execution or set-group-ID-on-file-execution
permission for who. Useful only if u or g
is expressed or implied in who.

or

4000(= u=s)Set user ID on file execution (file only)
2000(= g=s)Set group ID on file execution (file only)
1000(= u=t)Set sticky bit; see below and chmod(2)

[unixadmin_1]

Can any explain better solution for this so that i can report the issue to senior admin

[OldSchool]

what issue (i didn't see one listed)???

what solution (as i didn't see one of those noted either)???

SUID and SGID bits on the the permissions set the user or group id to that of the program when it is run.

It appears that you may be looking at an auditors report, and they found some suid stuff they didn't like?

if thats the case, consider sudo or powerbroker to allow users access to the required resources. if its not the case, you need to clarify what your concern / issue actually is.

[unixadmin_1]

If i got a list how to restrict SUID and SGID for a particular userids

[OldSchool]

"If i got a list how to restrict SUID and SGID for a particular userids"

they are attributes of the file / executable. as such they aren't associated with a particular user. I don't know if ACLs will manage this or not.

the only way I know of it to keep the users out of groups that can actually execute the file in question and have it owned by someone other than the user you wish to exclude.

[TTr]

> If i got a list how to restrict SUID and SGID for a particular userids

You should install sudo and allow the list of userids to run whatever command with it. The suid and sgid of the command do not get affected.