4 ms·

Setuid in Unix created to enable a game

93 points by zdw 4y ago

pjmlp 4y ago
Later on early GNU/Linux games followed the same idea by requiring setuid to use games written against SVGALib.
- 0x0 4y ago
  That's because direct i/o and device access for VGA card manipulation requires root access, it's not directly relates to file permissions. Same with X11 servers for the longest time (until the kernel started providing APIs for this)
  - pjmlp 4y ago
    Devices are files on UNIX, as we all know from its design. It was more due to lack of userspace APIs for graphics programming than anything else.
    - jjtheblunt 4y ago
      Minor nitpick from someone who wrote device drivers at a FAANG whose name starts with A and who is not based in Seattle: devices can have a presence as a device special file in the filesystem, but they might be not represented in the filesystem also...they might be hiding down some hardware bus, for example.
      - pjmlp 4y ago
        Depends on which UNIX.
    - mjg59 4y ago
      Eh you also need to call iopl() which is a privileged operation, it's not just about file permissions
      - pjmlp 4y ago
        It is a Linux specific API.
        deleted 4y ago
        [deleted]
  - toast0 4y ago
    On x86, i/o permissions could easily be delegated to a user-level task; although you'd need some mechanism to request/grant the access, as you probably wouldn't want to allow all programs to access the i/o ports. You'd probably need a mechanism to disable the built in VGA console as well.
- wahern 4y ago
  I think it's worth pointing out, in case it's not clear to people, that the SUID file mode bit is not synonymous with elevating to root privileges. Many programs use SUID or SGID to switch permissions to non-root users and groups. For example, games often use SUID or SGID so they can write to a shared scores files owned by, e.g., a "games" user or group. In such cases root privileges are never involved, not even to pivot. I prefer "SUID" to "setuid" because setuid is also a syscall and in fact the setuid syscall is more often used to drop privileges. In fact, in order to use setuid to elevate privileges a process needs to have already had that UID/GID as its saved UID/GID. Also, with all due respect to Douglas McIlroy (who of course is one of the fathers of Unix), the patent by Dennis Ritchie mentioned elsewhere refers to "SUID", not "setuid". Wikipedia treats SUID and setuid synonymously, too, but this is one of those times where Wikipedia should be a little more pedantic, notwithstanding the popular usage of "setuid" to refer to both concepts; especially because in practice they're typically referring to completely opposite changes in direction of privileges.
Maursault 4y ago
The history blurb in the Wikipedia article for setuid doesn't conflict, confirms a bit, and adds some details: The setuid bit was invented by Dennis Ritchie and included in su. His employer, then Bell Telephone Laboratories, applied for a patent in 1972; the patent was granted in 1979 as patent number US 4135240 "Protection of data file contents." The patent was later placed in the public domain.[1] [1] https://en.wikipedia.org/wiki/Setuid#History https://en.wikipedia.org/wiki/Setuid#History
- mort96 4y ago
  Man parents are insane. How could something like that possibly be patentable? How does giving gigantic companies monopoly on a fucking setuid bit do us any good? Do/did intelligent people like Dennis Ritchie really not feel any discomfort by the fact that their great work robs the world of that very work through the parent system?
  - simscitizen 4y ago
    No that's not the insane part. The insane part is that this is the only patent that came out of entire Research UNIX project [1]. [1] See the answer to question 25 on Rob Pike's blog: https://commandcenter.blogspot.com/2020/01/unix-quiz-answers.html https://commandcenter.blogspot.com/2020/01/unix-quiz-answers....
  - jjtheblunt 4y ago
    It's possible Bell Labs had the patent but also was entirely open to others using the idea freely.
    - mort96 4y ago
      So is it good to give a company the state-backed legal monopoly on the idea of a permission bit to run an executable as a different user, as long as the company elects to be real nice about it?
      - jjtheblunt 4y ago
enriquto 4y ago
Notice the author of this message! This mailing list is full of actual legends, speaking casually about minutiae of unix history. Do not go there unless you have a strong antidote against time sinks.

93 points by zdw 4y ago

pjmlp 4y ago

Later on early GNU/Linux games followed the same idea by requiring setuid to use games written against SVGALib.

0x0 4y ago
That's because direct i/o and device access for VGA card manipulation requires root access, it's not directly relates to file permissions. Same with X11 servers for the longest time (until the kernel started providing APIs for this)
- pjmlp 4y ago
  Devices are files on UNIX, as we all know from its design. It was more due to lack of userspace APIs for graphics programming than anything else.
  - jjtheblunt 4y ago
    Minor nitpick from someone who wrote device drivers at a FAANG whose name starts with A and who is not based in Seattle: devices can have a presence as a device special file in the filesystem, but they might be not represented in the filesystem also...they might be hiding down some hardware bus, for example.
    - pjmlp 4y ago
      Depends on which UNIX.
  - mjg59 4y ago
    Eh you also need to call iopl() which is a privileged operation, it's not just about file permissions
    - pjmlp 4y ago
      It is a Linux specific API.
      - deleted 4y ago
        [deleted]
- toast0 4y ago
  On x86, i/o permissions could easily be delegated to a user-level task; although you'd need some mechanism to request/grant the access, as you probably wouldn't want to allow all programs to access the i/o ports. You'd probably need a mechanism to disable the built in VGA console as well.
wahern 4y ago
I think it's worth pointing out, in case it's not clear to people, that the SUID file mode bit is not synonymous with elevating to root privileges. Many programs use SUID or SGID to switch permissions to non-root users and groups. For example, games often use SUID or SGID so they can write to a shared scores files owned by, e.g., a "games" user or group. In such cases root privileges are never involved, not even to pivot. I prefer "SUID" to "setuid" because setuid is also a syscall and in fact the setuid syscall is more often used to drop privileges. In fact, in order to use setuid to elevate privileges a process needs to have already had that UID/GID as its saved UID/GID. Also, with all due respect to Douglas McIlroy (who of course is one of the fathers of Unix), the patent by Dennis Ritchie mentioned elsewhere refers to "SUID", not "setuid". Wikipedia treats SUID and setuid synonymously, too, but this is one of those times where Wikipedia should be a little more pedantic, notwithstanding the popular usage of "setuid" to refer to both concepts; especially because in practice they're typically referring to completely opposite changes in direction of privileges.

Maursault 4y ago

The history blurb in the Wikipedia article for setuid doesn't conflict, confirms a bit, and adds some details: The setuid bit was invented by Dennis Ritchie and included in su. His employer, then Bell Telephone Laboratories, applied for a patent in 1972; the patent was granted in 1979 as patent number US 4135240 "Protection of data file contents." The patent was later placed in the public domain.[1] [1] https://en.wikipedia.org/wiki/Setuid#History https://en.wikipedia.org/wiki/Setuid#History

mort96 4y ago
Man parents are insane. How could something like that possibly be patentable? How does giving gigantic companies monopoly on a fucking setuid bit do us any good? Do/did intelligent people like Dennis Ritchie really not feel any discomfort by the fact that their great work robs the world of that very work through the parent system?
- simscitizen 4y ago
  No that's not the insane part. The insane part is that this is the only patent that came out of entire Research UNIX project [1]. [1] See the answer to question 25 on Rob Pike's blog: https://commandcenter.blogspot.com/2020/01/unix-quiz-answers.html https://commandcenter.blogspot.com/2020/01/unix-quiz-answers....
- jjtheblunt 4y ago
  It's possible Bell Labs had the patent but also was entirely open to others using the idea freely.
  - mort96 4y ago
    So is it good to give a company the state-backed legal monopoly on the idea of a permission bit to run an executable as a different user, as long as the company elects to be real nice about it?
    - jjtheblunt 4y ago

enriquto 4y ago

Notice the author of this message! This mailing list is full of actual legends, speaking casually about minutiae of unix history. Do not go there unless you have a strong antidote against time sinks.