what is difference betweem mode 4555 and 555

[Hanry Zhou]

I have a script, and if I set the permission to be "4555",and owned by "root", then the command "whoami" will get the result of "root", no matter who actunally runs it.
This is not what I want, so I am think change the permission of the script to "555". Is there any differences between these two permissions? and Should I do this change?

thanks.

[A. Clay Stephenson]

Octal 4000 is the setuid bit. For true executables, it enables the process to become the user matching the owner of the file. Eventhough shell scripts are not truly executable, the shell adopts this convention as well (unlike Perl, for example) and enables setuid behavior. This is considered extremely dangerous in Shell scripts and should be avoided unless there is a compelling need. Moreover, there is no guarantee that setuid behavior will continue to be supported or that it is supported if you move to a different platform.

Man 2 chmod for details.

[Michael Schulte zur Sur]

Hi,

from the man pages of chmod:
4000 (= u=s) Set user ID on file execution (file only)
meaning 4555 runs the programme as owner, in your case root.

greetings,

Michael

[Sundar_7 · Accepted solution]

I think you probably already know the answer :-)

Mode 4555 means set uid - which means the process will take the previleges of the owner of the executable irrespective of who creates the process. There is something called Effective UID and real UID. In this case real UID is the user who executes the script and effective UID is the owner of the script which is root in this case.

/usr/bin/passwd is the classical example of SUID binary in the system which allows normal users to change the password in /etc/passwd (or /tcb/files/auth/x/XXX) which is usually r--r--r--

you have other modes too 2xxx and 1xxxx

2xxx = set GID

1xxx = sticky bit.

- Sundar.

[Hanry Zhou]

Sundar,

How do I get the real user id in the script, the id who execute the script?

[Michael Schulte zur Sur]

Hanry,

whoami is fine.

greetings,

Michael

[Geoff Wild]

try:

who am i

instead of whoami

MYUSER=`/usr/bin/who am i|awk '{ print $1}'`
echo "hello $MYUSER"


Rgds...Geoff

[Hanry Zhou]

Geoff,

U did not get what I am asking

if I have set the permission to be 4555 on my script xyz, then the result of whoami will be "root", no matter who is actually running it.

So, my quetion is how to get the uid in the script xyz, and the id is the one who I running the script, not the "root".

[Patrick Wallek]

Have another look at Geoff's response.

Note the spaces in the command 'who am i'. There is a difference between 'whoami' and 'who am i'.

I just ran a quick test on a script with 4555 permissions and root as the owner.

Here is the script:

# ll test
-r-sr-xr-x 1 root sys 108 Mar 23 14:45 test*

# cat test
#!/usr/bin/sh
WHOAMI=$(whoami)
echo "whoami = ${WHOAMI}"
WHO_AM_I=$(who am i)
echo "who am i = ${WHO_AM_I}"

Here is the output when run as user wallekp:

$ ./test
whoami = root
who am i = wallekp pts/39 Mar 23 14:43

[A. Clay Stephenson]

That is exactly right, whoami displays the EFFECTIVE USER whereas who am i (which is a completely different command) displays real user (actually its best guess).

[Sundar_7]

Hi,

You can use an alternate method as well

Within the script

UNIX95= ps -p $$ -o uid,ruid | grep -v UID | read EF REAL

EF holds the effective user ID

RUID - Real user ID

Thanks,

Sundar

[Mike Stroyan]

You can get the effective uid with 'id -u' and the real uid with 'id -u -r'.

Setuid scripts are very dangerous. Most shells can be coerced to run whatever you want by setting environment variables that affect their behavior. A setuid script is an invitation to hack it.