如何在非root用户的程序中设置setuid位? [英] How to set the setuid bit in a program of a non-root user?

问题描述

我正在尝试将setuid位置1来使python脚本可执行.该程序属于用户"bgmc"，必须在目录"/home/bgmc"中创建一些文件，但被另一个用户客户端"调用.确实，我不希望用户客户端"更改程序创建的文件.我使用了c-wrapper来调用该程序(请参见关于shell脚本的setuid ):

I am trying to make a python script executable with the setuid bit set. The program, belonging to user 'bgmc', must create some files in the directory '/home/bgmc', but is called by another user, 'client'. Indeed, I don't want user 'client' to change the files created by the program. I used a c-wrapper to call the program (see setuid on shell scripts):

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

int main()
{
    setuid(0);
    system("/home/bgmc/myprogram.sh");
    return 0;
}

我将程序的setuid位设置为on.当c编译的程序属于root时，该程序运行良好，并创建了预期的文件.然后，C编译程序的属性为:

I set the setuid bit of the program on. When the c-compiled program belongs to root, the program runs well and creates the expected file. The properties of the c-compiled program are then:

8 -rws--x--x 1 root root 4657 Mar  2 16:25 myprogram

但是，当我将myprogram的用户组更改为bgmc:bgmc时，该程序无法再创建文件:权限被拒绝".我试图更改这一行:

However, when I change the user-group of myprogram to bgmc:bgmc, the program cannot create the file anymore: "Permission denied". I tried to change the line:

setuid(0);

具有:

setuid(1002);

因为1002是'bgmc'的用户ID(为此我使用了命令"id -u bgmc")，但这无济于事.

since 1002 is the user id of 'bgmc' (I used command "id -u bgmc" for this) but this didn't help.

我宁愿不授予对该程序的root访问权限.有办法防止这种情况吗?

I would rather prefer not giving root access to the program. Is there a way to prevent this?

推荐答案

对此不确定，因为您的信息信息非常稀疏，但是您忘记了在更改所有者后重置文件的权限吗?在大多数系统上，所有权的任何更改都会自动删除setuid位，如果需要，您必须自己重新添加.

Not sure about this since your question is very sparse on information, but did you forget to reset the permissions on the file after changing the owner? On most systems, any change of ownership automatically removes the setuid bit and you have to re-add it yourself if you want it.

还要注意，setuid shell脚本是一个主要漏洞；这就是为什么内核不允许您直接制作Shell脚本setuid的原因.至少您应该:

Also note that setuid shell scripts are a major vulnerability; this is why the kernel does not allow you to make a shell script setuid directly. At the very least you should:

1. 使用execve而不是system进行调用，并且
2. 清除环境中的所有内容(或将新的空环境传递给execve).

1. Use execve rather than system to call it, and
2. Clear out everything from the environment (or pass a new empty environment to execve).

现在，任何可以运行该程序的人都可以通过控制环境变量来使其做任何自己想做的事.

As it is now, anyone who can run the program can make it do whatever they like by controlling environment variables.

这篇关于如何在非root用户的程序中设置setuid位?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！