3 ms·
So, what is the correct default (nothing self-built, please) command to start a shell using the privilege level of some less privileged user? Setuigid doesn't s
by Tuna-Fish 3y ago
So, what is the correct default (nothing self-built, please) command to start a shell using the privilege level of some less privileged user? Setuigid doesn't seem to be included by default in distributions.
- klodolph 3y agoThe su command is correct for that purpose, as is sudo. This is kind of a subtle point that the article makes—the problem is that “su” is not good for dropping user privileges in general, but it does work if you are a user trying to spawn an interactive shell as another user. Keep in mind that you are giving control of your terminal to that less-privileged account, and that this is a potential point of privilege escalation.
- tkhattra 3y agocheck out the setpriv command - https://man7.org/linux/man-pages/man1/setpriv.1.html https://man7.org/linux/man-pages/man1/setpriv.1.html
- cwillu 3y agoAccording to man su(1): “su is mostly designed for unprivileged users, the recommended solution for privileged users (e.g. scripts executed by root) is to use non-set-user-ID command runuser(1) that does not require authentication and provide separate PAM configuration. If the PAM session is not required at all then the recommend solution is to use command setpriv(1).”