setuid / setgrpid

[Weary in West Chester]

Hello group. I need your help again. Please let me know if this can be done.

I have a directory and files that have to be locked down (permissions 750) so that only the owner can write to it and users in the group can execute the scripts in it. Two of the scripts in this directory generate other scripts into this same directory and would therefore prevent anyone other than the owner from running them. I thought that by setting the setuid or grpid bit on for the two scripts that it would allow someone other than the owner to execute and run the scripts successfully, but when it came time to generate the new files I get the "cannot create" message. Would anyone have any ideas on how I could get this working here? I thank you in advance for your help.

[Ian Dennison_1]

Hey Weary (nice handle!)

What is the User and Group of the scripts with the setuid and setgid set? Is it the same user / group as the owner of the directory?

I think you will need to use Sitcky Bit (chmod +t) to get the script to run as the owner or group it is assigned.

I hope this is what you are after. Share and Enjoy! Ian

[Umapathy S]

Weary,

Did you chmod 4750 on the scripts which are going to run by all.

HTH,
Umapathy

[David Child_1]

Weary,

Which UID owns the directory? Only the login that owns your 750 directory should be able to create new files (unless maybe you use the setuid of the 'parent' script to match the directory).

If you can, please post the UID/GID of the directory and scripts, as well as the UID/GID of the logins trying to run scripts.

Thanks
David

[James R. Ferguson]

Hi Weary:

If you set the 'setgid' (S_ISGID) bit on a directory, then files created in this directory
have a group equal to the group of the directory.

If you set the 'sticky' bit (S_ISVTX) on a directory, then a process must have write permission for the directory and either bye the file owner or the directory owner to delete a file in the directory.

Regards!

...JRF...

[Weary in West Chester]

Here is the scenario I am trying to create here:

USER (UID) - GRP (GRPID)
------------------------
user1 (101) - mis (200)
user2 (102) - mis (200)

drwxr-x--- user1 mis 8192 June 01 12:00 dir1
-rwxr-x--- user1 mis 200 June 19 09:59 file1

dir1 is the directory I want to secure from everyone execept the owner, user1. I would like user2 to be able to run "file1" (which is in dir1) without giving him write permission to the dir1 directory. However, when file1 runs, it generates a couple scripts right into dir1, so the script fails because he, user2, cannot write to dir1. I thought that by setting the permissions on file1 to rwsr-x--- that it would allow user2 to run file1 as if he WAS user1.

Could you also please clarify for me if I am in fact using the correct terminology too. The permissions rwsrwsr-x ... with the "s" in the execute column, is that the setuid and setgrpid permissions? What is the difference between setuids and the sticky bit, or are they the same?

[Weary in West Chester]

David,

Above is the info you asked for. Can you offer any suggestions on how I can make this work?

[Patrick Wallek]

OK, to answer your last question first, no SUID/SETGID is NOT the same as the sticky bit (see James Ferguson's answer).

Now, I have just done a quick and dirty test.

I did the following:

# mkdir /dir1
# chown wallekp:adm /dir1
# chmod 750 dir1
# cd dir1

I then created a file called 'test'

# cat test
#!/usr/bin/sh

touch afile

# chmod 4750 test
# chown wallekp:adm test

# su - anotherid
$ cd /dir1
$ ./test
$ ll
-rw-r--r-- 1 wallekp adm 0 Jun 30 13:50 afile
-rwxr-x--- 1 wallekp adm 28 Jun 30 13:51 test


As you can see, the test succeeded

Now as a verification, I did:

# chmod 750 test
# su - anotherid
$ cd /dir1
$ ./test
touch: afile cannot create

So as you can see, the SUID does indeed behave as you expect. Something you need to check, when you are running your script, are you absolutely sure that the files you are trying to create are being created in /dir1? I would fully qualify the path to those files that need to be created, ie. /dir1/filename, so that you are positive.

It definitely should work the way you expect.

[Caesar_3]

Hello!

You can work with the permissions as you
had the answers here.

Also for your problem you can start to use the
SUDO program that there you can say which
user can run which script and the scripts
will belong to owner.

You can download from:
http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.6.6/

Caesar

[Donny Jekels]

hey weary, in the west.

sudo does that for you. much easier to maintain than flipping suid bits.

but if you love hard work, than go for it, or just to learn how its done.

as it is, that is what sudo does anyway.

http://www.sudo.ws

live free or die
Donny