3 ms·

Most current distros prevent you from making setuid bash scripts, on security grounds. But you can get most of the same effect with a specific sudoers entry.

by mappu 3y ago

lloeki 3y ago
> Most current distros prevent you from making setuid bash scripts _any_ shebang script really... except perl scripts, because perl has taint mode turned on automatically when uid != euid https://perldoc.perl.org/perlsec#Taint-mode https://perldoc.perl.org/perlsec#Taint-mode Note that there may be a fundamental race condition on some systems: https://perldoc.perl.org/perlsec#Shebang-Race-Condition https://perldoc.perl.org/perlsec#Shebang-Race-Condition Also see the noted use of `sudo -T`: https://perldoc.perl.org/perlsec#Using-Sudo https://perldoc.perl.org/perlsec#Using-Sudo I lament the recent removal of taint mode from Ruby :( as tainting is a powerful mechanism that could go way beyond scripts: imagine Rack / Rails #html_safe but via tainting so it could have worked more thoroughly (e.g concatenate/interpolate/format a tainted user string into a SQL snippet would blow up, preventing a whole class of SQL injections by design) Some folks used to use taint for CGI/mod_perl to such great effect. It's not a magic bullet by any means (security is hard!) but it's a really effective tool still.
linschn 3y ago
I use a C wrapper that calls the shell script. Ugly, and I need to harden the script a bit more, but it works :) https://gitlab.com/edouardklein/suc/-/blob/master/suc_wrapper.c https://gitlab.com/edouardklein/suc/-/blob/master/suc_wrappe...
throwawaymobule 3y ago
Is there even distros that let you do it? When I wanted to do this myself all things I read led me to believe that the setuid doesn't apply because the file itself isn't running, the thing in your shebang is. Until I found the wrapper file in the GitLab repo, I was holding out hope as I read through that there was some way.

Most current distros prevent you from making setuid bash scripts, on security grounds. But you can get most of the same effect with a specific sudoers entry.

by mappu 3y ago

Most current distros prevent you from making setuid bash scripts, on security grounds. But you can get most of the same effect with a specific sudoers entry.

lloeki 3y ago

> Most current distros prevent you from making setuid bash scripts _any_ shebang script really... except perl scripts, because perl has taint mode turned on automatically when uid != euid https://perldoc.perl.org/perlsec#Taint-mode https://perldoc.perl.org/perlsec#Taint-mode Note that there may be a fundamental race condition on some systems: https://perldoc.perl.org/perlsec#Shebang-Race-Condition https://perldoc.perl.org/perlsec#Shebang-Race-Condition Also see the noted use of `sudo -T`: https://perldoc.perl.org/perlsec#Using-Sudo https://perldoc.perl.org/perlsec#Using-Sudo I lament the recent removal of taint mode from Ruby :( as tainting is a powerful mechanism that could go way beyond scripts: imagine Rack / Rails #html_safe but via tainting so it could have worked more thoroughly (e.g concatenate/interpolate/format a tainted user string into a SQL snippet would blow up, preventing a whole class of SQL injections by design) Some folks used to use taint for CGI/mod_perl to such great effect. It's not a magic bullet by any means (security is hard!) but it's a really effective tool still.

linschn 3y ago

I use a C wrapper that calls the shell script. Ugly, and I need to harden the script a bit more, but it works :) https://gitlab.com/edouardklein/suc/-/blob/master/suc_wrapper.c https://gitlab.com/edouardklein/suc/-/blob/master/suc_wrappe...

throwawaymobule 3y ago

Is there even distros that let you do it? When I wanted to do this myself all things I read led me to believe that the setuid doesn't apply because the file itself isn't running, the thing in your shebang is. Until I found the wrapper file in the GitLab repo, I was holding out hope as I read through that there was some way.