What is good security measure to give normal user some super user power

babbab · 01-22-2016, 09:45 AM

supposed two normal user share dir in same group. and if root wants to grant those two users power to change group id to group they're sharing, but don't want to give any other power, how can that be achieved?

I thinking place a setuid root shell script that changes group id to group id they're sharing without permission to change the content of the script.

I heard it's security risk. what other safe way to grant normal user to change group id of file and dir but prevents other power?

Keruskerfuerst · 01-22-2016, 10:22 AM

You can also use "sudo".

ondoho · 01-22-2016, 12:40 PM

babbab, i think what you want can be achieved with linux file permissions and sudo.
you should read up on the subject of file permissions, and sudo's documentation.
maybe tldp.org can help.

babbab · 01-22-2016, 02:55 PM

No I mean I want to give super power to normal user but don't want to give super power to normal user.

I want normal user able to execute script of change group id of file on certain directory only without making any change to the script, so it's very specific power. But I don't want to give any other super power to normal user.

I was thinking setuid of script without write permission, but is it safe?

astrogeek · 01-22-2016, 03:20 PM

Quote:

Originally Posted by babbab

No I mean I want to give super power to normal user but don't want to give super power to normal user.

That makes no sense.

But to understand why setuid scripts is a very bad idea, see here.

Quote:

Originally Posted by babbab

I was thinking setuid of script without write permission, but is it safe?

No.

And not only is it not safe, it is not possible on most distros without modifying the kernel.

Read about sudo and file permissions as already noted, to accomplish your end goal.

Habitual · 01-22-2016, 04:26 PM

Allow A Normal User To Run Commands As root Under Linux / UNIX Operating Systems

wagscat123 · 01-22-2016, 04:44 PM

Do you mean running "chmod +x script.sh" to make a script run with "./script.sh"? You can just have a normal user run that on a shell script, and everything is cool if the script doesn't execute any root commands or edit files that the user can't edit.

babbab · 01-25-2016, 07:28 AM

Quote:

Originally Posted by babbab View Post

>>>No I mean I want to give super power to normal user but don't want to give super >>>power to normal user.

>>That makes no sense.

it makes sense, it's the language incapable of expressing such thing

Habitual · 01-25-2016, 08:51 AM

Quote:

Originally Posted by babbab

No I mean I want to give super power to normal user but don't want to give super power to normal user.

I want normal user able to execute script of change group id of file on certain directory only without making any change to the script, so it's very specific power. But I don't want to give any other super power to normal user.

I was thinking setuid of script without write permission, but is it safe?

Grant either chmod, or chown, or other similar coreutils to the "normal user" using the link I gave you earlier
in the Example

Code:

jadmin ALL= NOPASSWD: /path/to/coreutil