Baslinux mailing list

["Anthony J. Albert" <albert AT polaris.umpi.maine.edu>]

On 18 Aug 2004 at 0:15, Sindi Keesan wrote:
>man Xvesa says something about security holes if you allow users to use 
>Xvvesa.  A web search on Xvesa and suid root says 'kdrive servers must be 
>suid root wo work, which is _not_ a good thing.  Maybe it is possible to 
>use the old wrapper that X used for this purpose but this has not yet been 
>investigated'.
>
>Hal said there were two ways to make something suid root (superuser ID 
>soMething or other - can anyone explain more?) with chmod and numbers or 
>u+s by the new method.  Another online search found someone trying to use 
>samba and being told something had to be run suid root and to do this type 
>chmod +x /path/filename  so I typed (as root) chmod +s Xvesa (from the 
>directory where it resides).
>
>I hope someone more experienced can explain what suid root is and why you 
>are supposed to type u+s or +s (same thing?).

Quoting from _Using_Linux_ pp 629 (Que, 1995):

SUID and SGID Programs
There are two additional permission bits associated with a file--the 
SUID and SGID bits.  SUID stands for Set User ID and SGID is Set Group 
ID.  Programs with these permissions behave as if they were owned by 
different UIDs when they are run. When an SUID program is run, its 
effective UID is set the same as the user that owns the program on the 
file system, regarless of who is actually runing the program.  SGID is 
similar except that it changes the group ID instead.  Although the 
SUID/SGID feature can be useful, it can present a big security hole. 
SUID programs are generally used when a program needs special 
permissions, such as root permission, in order to run.


Thus, you'd really rather not have any SUID programs on your system, 
though there's bound to be a few that require it.  'SUID root' means 
that the program must be set to be owned by root, and then the SUID 
permission flag applied to the program. 

'chmod +s <filename>' or 'chmod 4555 <filename>' are two possible 
commands for setting the SUID bit on a file.  See 'man chmod' for more 
info on these commands.

Anthony Albert
===========================================================
Anthony J. Albert                     albert AT umpi.maine.edu
Systems and Software Support Specialist          Postmaster
Computer Services - University of Maine, Presque Isle
        "This is only temporary, unless it works."
                        --- Red Green