Subject: RE: How do I allow users to run a single command as root?

From: Casper BodenCummins <[email-masked]>
Date: Fri, 16 Aug 1996 13:59:48 +0100

What you need here is to set the setuid bit. Run this command as root:

   chmod +s filename

Then when you run ls filename you should see something like:

   rws--s--x  1  root      root         4304 Aug 16 13:51 filename

Now when a normal user runs the command, it executes as root. Be careful
with this ability!

Another point of interest: in /etc/fstab you can specify an option of
'nosuid' on a mount point. This prevents setuid programs from running on
the specified filesystem.

Casper Boden-Cummins.

>----------
>From:
>	[email-masked][SMTP:[email-masked]]
>Sent: 	16 August 1996 04:49
>To: 	[email-masked]
>Cc: 	The recipient's address is unknown.
>Subject: 	How do I allow users to run a single command as root? 
>
>I've written a few scripts to automatically connect to my ISP, which
>has 
>several incoming lines. What I'd like to do is make these scripts so
>that
>the user running them does not have to be root. I've tried changing the
>
>permissions to rwx__x__x, still owned by root, but it doesn't do the
>job.
>I need to make this simply a command a user can run without them having
>to know the root password.
>
>Any ideas on how to accomplish this? I tried reading the man pages, but
>
>su (which I think is what I would need to use) is not exactly what I'd 
> 
>call well documented. 
>
>Thanks,  
>
>Tim O'Brien 
>
>E-mail: [email-masked]
>	
>
>

---

From: Rob Browning <[email-masked]>
Date: 16 Aug 1996 10:25:05 -0500

> What you need here is to set the setuid bit. Run this command as root:

Not to be nasty, but this is generally a *REALLY BAD IDEA* unless you
know *exactly* what you are doing.  If "filename" was not designed with
extremely careful attention to the fact that it's going to be run suid
root, you can be opening up your system to all kinds of security
attacks, or accidental disasters by enabling suid root.

I'm talking about attention to things like explicitly setting the
PATH, checking and setting IFS, etc.  If it's a perl script, using the
"taint" checks helps, but you have to know enough perl to be able to
fix the problems it reports.

Don't do this.  Use sudo, super, or some equivalent.

[end preach mode]

--
Rob