execute files without read permission

[Carme Torca]

Hi,

Does anyone knows know I can put a file without read permission, but with execution permission.... I want this because I don't want the user see inside the file.

Is it possible?
Thanks!
Carmen.

[Robert-Jan Goossens]

Hi Carmen,

# chmod 100 file

Robert-Jan

[Patrick Wallek]

If you are talking about a shell script, it is not possible by just changing the permissions. A shell script MUST be readable to be executable.

[Sanjay_6]

Hi,

Yes it is possible. Set the permissions of the file accordingly.

Hope this helps.

Regds

[Carme Torca]

It doesn't works fine...
I put
chmod 070 to /tmp/prova.txt
-----x--- 1 root oinstall 47 24 Mar 16:33 prova.txt

But If I do:

[:oracle]/tmp> ./prova.txt
ksh: ./prova.txt: cannot open

[Steven E. Protter]

a file can have execute permissions(see above) without read permissions.

root can execute a script with no read permissions because in reality root can read ANYTHING.

Thats because its all powerful.

On a practical level, it might help to know what you are trying to accomplish.

SEP

[Mark Grant]

You can't do this except for root. You need read permission to execute it. The only way around this that I can think of is to have a SETUID root wrapper program that calls the script.

[A. Clay Stephenson]

The answer is both yes and no. If the file is a true executable (e.g. a compiled 'C' program) then all you need are the execute ('x') permissions but I suspect that you are talking about a script. A script is interpreted so the shell must be able to read the file before it can execute it. In fact, the execute bits on a shell script only have meaning to the shell itself rather than the OS.

There are some utilities which can compile your shell script into a true executable; the commercial versions work quite well.

[Robert-Jan Goossens]

Hi,

Made a small script with ls -la permissions 100 --x------ rj

/tmp/r# more rj
ls -la
/tmp/r# ls -la
total 48
drwxr-xr-x 2 root sys 1024 Mar 24 16:39 .
drwxrwxrwx 8 bin bin 22528 Mar 24 16:44 ..
---x------ 1 root sys 7 Mar 24 16:44 rj
/tmp/r# ./rj
total 48
drwxr-xr-x 2 root sys 1024 Mar 24 16:39 .
drwxrwxrwx 8 bin bin 22528 Mar 24 16:44 ..
---x------ 1 root sys 7 Mar 24 16:44 rj


Regards
Robert-Jan

[Mark Grant]

Robert-Jan,

But you are "root". As SEP said, root can read "unreadable" files. Try is as a non-root user.

[Robert-Jan Goossens]

YUP you are right Mark, did not see your post, sorry Carmen.

[Carme Torca]

Hi,
How does work SETUID root wrapper program??
Could you put me an example??

Thanks!
Carmen.

[Carme Torca]

There are some utilities which can compile your shell script into a true executable; the commercial versions work quite well.....

Does you know the name of one utility of its??

Thanks!!
Carmen.

[Mark Grant · Accepted solution]

Simple one would be

main(){
system("}

save as mywrapper.c

Compile with cc -s -o mywrapper mywrapper.c

chown root mywrapper

chmod 6755 mywrapper

In my view, this is a worse security hazard than allowing people to read your script (particulary using system()) but it might be enough for your needs.

[RolandH]

@ Robert

that is what Clay tried to explain.

root can read everything so no need for read rights. As normal user your script needs these rights to work:

-x-x------ 1 user group 7 Mar 24 16:44 rj

But I have another solution for you carmen. If you don't want that a user can look in a script, because of a password in the script you can use the script compiler shc from
http://big.asknet.de/ for me it works fine.
But when your script MUST run under root rights you should try sudo.


Roland

[Carme Torca]

Hi,

I have prove the script compiler shc from
http://big.asknet.de/, but it shows me:

> shc -f prova.sh
shc Invalid script's first line: #/bin/ksh
shc: Error 0

so, I have prove to do:

int main()
{
system("prova.sh");
}
and it's works fins.
Thanks everybody!!!
Carmen.

[RAC_1]

The first line should be #!/usr/bin/sh

Anil

[RolandH]

I have testet it with Korn-Shell, too (#!/usr/bin/ksh). It has worked. But do not know if it will work with more complex Korn-Shell-scripts.

Roland