StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>As a general principle you need your effective uid (euid to be root) either when you are are writing the file or when you perform a chown(2) on the file. </p> <p>If you are doing this under Linux then there are <em>linux specific</em> methods that you can use.</p> <h1>Generic Solution</h1> <h2>Without availability of sudo</h2> <p>This is the old UNIX DAC approach, it's fraught with peril. It assumes that you do not have something like <code>sudo</code> installed or cannot install it.</p> <p>Your executable should be owned by root and have the executables setuid bit set. </p> <h2>Process</h2> <p>You should use seteuid () to drop your privileges from root to bobby for most of the operation, including writing. When you are done, bring your privilege level back up to root using seteuid(0) and perform a chown() (or fchown on the fd) on the file to change its ownership to root.</p> <h3>some basic safety</h3> <p>For safety set it up so that your executable is owned by root:safegrp where 'safegrp' is name of a group unique to users who are allowed to execute this file (add bobby to safegrp) ; and ensure that the setuid executable's mode is 4510 ; </p> <h2>With availability of sudo</h2> <p>If sudo is available on your system then follow the same process as above for dealing with privileges within the executable but DO NOT set the file mode to setuid, have <code>safegrp</code> added to sudoers for this executable and now bobby can run it with sudo /your/bin/prog </p> <h2>Linux specific solution</h2> <h3>POSIX.1e</h3> <p>It is possible to have tighter control over the file use POSIX.1e capabilities support. In your case you wish to grant SYS_CHOWN to your program;</p> <p>For security reasons, I would probably set that up as a COMPLETELY separate binary or a sub process and still use sudo and perform appropriate dropping of privileges.</p> <p><a href="http://bencane.com/2012/05/acl-using-access-control-lists-on-linux/" rel="nofollow">linuxacl</a>[ACL Using Access Control Lists on Linux] has excellent tutorial on this topic</p> <h3>SE-Linux</h3> <p>You can use Mandatory Access Control to limit the access to such a dangerous binary but SE linux is a pain to configure :^) although a possibly a good approach</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload