3 ms·
Using a setuid helper (even if it's called sudo) is still starting a program as root.
by geocar 12y ago
Using a setuid helper (even if it's called sudo) is still starting a program as root.
- icebraining 12y agoNot necessarily; sudo on Fedora has CAP_SETUID instead of the setuid bit, so it doesn't actually run as root. http://fedoraproject.org/wiki/Features/RemoveSETUID http://fedoraproject.org/wiki/Features/RemoveSETUID
- ptx 12y agoBut CAP_SETUID, unless I'm confusing it with something else, can be used to set the UID to 0 and thereby gain all the same privileges as if the program had been started as root, can't it? Presumably it has some advantage that I'm not getting – does it have to be combined with e.g. SELinux to be useful?