DelphiFAQ Home Search:

How to set the setuid and setgid bit for files in Unix

 

comments4 comments. Current rating: 5 stars (3 votes). Leave comments and/ or rate it.

Question:

I need to set setuid and setgid bit for files.
Please show me how to. And what is the exact purpose of the uid bit?

Answer:

In the shell just type the commands shown in the box below to set the uid or gid bits.

The purpose of the uid bit:
If you change an executable file to have the setuid bit set then when any other user runs this executable the effective user ID of the process will be switched to the user that owns the file. The same way, if you set the gid bit, then the process will be executed under the group of the file. You have to be very careful with this feature as one can easily create a hard-to-spot security whole with it.
The purpose is usually to give the executable file the ability to write to a certain file - e.g. a log file - that the regular user cannot write to. When it runs under the owner's ID, it can write to that file.
Having the process execute under a different user id has some other side effects for example coredumps are disabled and the C runtime library ignores or deletes some environment variables.

// setuid
chmod 4555   executable_file

// setgid
chmod 2555   executable_file

Comments:

2009-01-26, 19:48:07
anonymous from United Kingdom  
rating
2009-10-20, 05:56:42
anonymous from India  
very helpful
2011-11-04, 09:44:31   (updated: 2011-11-04, 09:46:21)
anonymous  
rating
This is helpful.
2012-04-03, 09:42:52
anonymous from Germany  
rating

I would like to
disable Setuid and Setgid Binaries because of security. I found this post:

'Setuid programs run with the privileges of the file's owner
(which is often root), no matter which user executes them.
Bugs in these programs can allow privilege escalation attacks.
To find setuid and setgid programs, use the commands:
find / -perm -04000 -ls
find / -perm -02000 -ls
The following files should have their setuid or setgid bits
disabled (using chmod ug-s programname) unless
required for the purpose listed in the second column. The
programs can always have their setuid or setgid bits re-enabled
if necessary for the purpose shown. '

...bur HOW can I re-enable their setuid or setgid bits???

Thank you very much
Vera

 

 

NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.
 

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture: