Giving a script root access

[Ullrich Rieger]

I created a script, containing the statement
chown user myfile
to change the owner of a file that I am not owner of. I set the s-bit of the script file and tried to execute the script as an ordinary user. I got the messsage:
myfile: not owner

setting the s-bit of a chown works fine.
What's wrong?

[John Palmer · Accepted solution]

Is the first line of your script:-

#!/usr/bin/sh
or
#!/usr/bin/ksh

This is required to get setuid to work with a script. Test it by getting the script to execute 'id'.

Regards,
John

[James R. Ferguson]

Hi:

For what it's worth, here's two comments.

Of course, remember the dangers associated with suid scripts. You'll certainly be asked to explain where and why you have them by an auditor.

Also, depending on the commands you are using within your scirpt, you'll probably need/want to to specify absolute paths. Root's default PATH includes /usr/sbin where common user's don't (and don't need to).

...JRF...

[Alan Riggs]

Also -- please remember to trap escape sequences in your script. You do not want to allow a user to gain a root shell simply by hitting CTRL-c.

[Bill Hassell]

To reiterate the issues about security: set user-ID scripts for root access are the worst security hole you can provide. It is quite easy to subvert a script by interrupting it or change the environment in which it runs to gain super user privileges.

Strongly reconsider the use of scripts and instead, write a program with appropriate precautions. Executables are much more secure in a suid application.