Assign root privileges to an other user

[Sergio Tancredi]

Hi,
I need to assign the permission of execution of one shell script to an only user (beyond root).
The owner of this shell script is root.
This script executes various commands (It kills processes of which the owner is root, It changes the permissions to some files of which he is not owner, etc...).
I've tried with the command 'chmod +s myscript' but it has not worked.
Some errors:
chmod: Not owner
kill: PID: permission denied

Notes: I can't use "sudo" (It's not supported by HP)!!!

Thanks in advance,
Sergio

[Thierry Poels_1]

Hi,
chmod +s is only valid for executables.
You could indeed used sudo,
or you can write & compile a little C-script which simply executes your shell script, and then chmod +s the C-executable.
good luck,
Thierry.

[Steffi Jones_1]

Hello,

I can think of one other way, but sudo (even I think that sudo would do great because if gives you a monitoring feature as well).

Start restricted sam and set it up through sam.
Restricted sam is started with

#sam -r

Steffi Jones

[Kevin Wright]

You need to be the owner of the file to do a chmod, if the file is owned by root, which I assume it is, then become root, and do a chmod 4755. this will set the SETUID bit, and whoever executes this command will cause it to run as if root ran it..just like the passwd command. make sure that nobody else can write to this file, and the script should work.
also chmod u+s file will work.

[Thierry Poels_1]

Kevin, Sergio is refering to a shell script. Shell scripts cannot have the sticky bit set.

[Piotr Bronisz]

Hi,
I do not agree with Thierry Poels.
chmod +s is valid for scripts also.
You have to insert the first line:
#!/usr/bin/sh
and suid works.
Piotr

[Joseph A Benaiah_1]

I just thought that I would add my few pennies to this. In addition to ensuring that the suid is set i.e 4755, the script needs to be owned by root. This executes all commands with an euid of 0 when the script is run.

In general, suid scripts and programs do represent a security risk. I myself only use the root suid on programs written in C if absolutely necessary.

Cheers,

Joseph.

[Ed Ulfers]

I have taken a slightly different approach to solving this problem in our environment, and this works:

Create a new group whose only member is this userid you want empowered. (Alternatively, I use the built-in group "adm" for administration purposes)

chown root:
chmod 4750
This allows members of this restricted group to execute the script which runs as root (from the sticky bit).

I use it for one of my applications that opens port and needs root ownership when running.

Hope this helps...
Ed Ulfers

[Sergio Tancredi]

Hi All,

I have tried with sam -r but I would prefer that the user in issue assumes root privileges only during the execution of the shell-script.

The better thing could be the C-script.
Could you give me more details about this?

Thanks to everyone,
Sergio

[Manuel Plaza]

Hi Sergio,

I am using sudo with HP-UX 10.20 and 11.0 and it's OK. I think that this is a very good solution.

Regards,

Manuel

[Shannon Petry]

Well, other than C-Shell there is really no such thing as C-Script! C-Shell is not too much different than borne or korn shell!

What was being referred to is a C Program. It is relatively easy to use the system() in C to call a standard command. It gets a bit more complex to have this program and what it runs to run as root.

C executes very fast, and has the ability to control all aspects of the environment it is running in. You also have security in the fact that unless you give away your source code, noone can see what is going on. Unlike a script where a user has to have read access. A smart user could potentially use this to do lots of damage to your system!

If your not familiar with Unix C programming, then this will not be easy. If you have no C experience/knowlege at all, then your pretty much SOL cuz it will not be quick and dirty to learn.

Advice. Take C class, then Unix C programming. HP has some nice classes for this, as do lots of Universities.

If you need quick answers, then stick with the scripting for now and follow the advice of others. Or hire a consultant/developer to make the program for you.

Regards,
Shannon

[Thierry Poels_1 · Accepted solution]

okay, a little bit more detail :

create a file prog.c with following 4 lines:
main()
{
system("/your/dir/yourscript.sh");
}

then compile this little C-program:
cc prog.c

this results in an executable file a.out which you might want to rename to whatever ...
mv a.out whatever
chmod +x whatever # make it executable
chmod +s whatever # set sticky bit

Now let the user execute "whatever", and he will run "yourscript.sh" as root.
(and also award some points to the boys here ;)
good luck,
Thierry.

[Sergio Tancredi]

Thanks to everyone for any help.
My problem is now resolved !!!
:-)))

Sergio