SUID bit enaled on the filesystem

[sheevm]

Hi All,

What is the pros/cons of setting the SUID bit on a filesystem? Appricaite your comments.

Thanks
kesh

[Steven E. Protter]

Shalom,

Pro: It will make it much easier to hack your system. No. That's a con.

Con: It will enable you to create security hazards, eg programs with root privileges that can be used to hack your system.

It will make you fail your next security audit.

It would be helpful to know why you are asking this question.

SEP

[Court Campbell]

Do you mean you want to add the suid option to the mount command or that you want to set the suid bit on the directory that the filesystem mounts?

If you mean as a mount option it will allow files with the suid bit set to run suid. But if you mean you want to suid a directory. Then when a file is created in the directory the file would have the same owner as the SUID directory, regardless of who creates the file.

[A. Clay Stephenson]

There is no SUID bit on a filesystem rather it is a mount option (typically -o suid or -o nosuid) to allow or not allow the setuid bit on files to function. While it may appear to be a good idea to disable setuid programs, be very careful. For example, if setuid is not allowed on /usr then you just broke the passwd command when used by ordinary users. Similarly, if you disabled setuid execution you would break sudo --- which is used as a secure tool.

As a general rule, I'm not opposed to setuid programs but setuid scripts are a dangerous security hole and should never be allowed.

Rather than setting the nosuid mount option, it typically makes more sense to have a daemon run periodically and look for any setuid/setgid files and compare via cksum to known, safe versions. After a system setup, I typically create a database that has the time of last modication, owner, group, and mode of each setuid/program and then periodically compare my system to the values in the database.

[Bill Hassell]

In /etc/fstab, the default is to enable SUID programs and scripts to run. However, it is a VERY good idea to disable SUID for user-writable directories such as /var /tmp and /home. DO NOT EVER add nosuid to OS filesystems such as /opt, /usr and /.

[Sundar_7]

I know you might have gathered enough from the above posts to decide for yourself.

Sometimes SETUID is a necessity for certain applications. One example could be Oracle, which will not start if the SETUID is not set/allowed on its oracle binary file.

It is best to evaluate the setting on a case by case basis. You may need to leave it at the defaul in certain cases as discussed above.