Running root commands without sudo

[Dazzle]

I am currently writing a program for a series of system related configuration, which involves a lot of messing around with programs that require root access. However, I do not wish to use sudo in order to be able to use these commands, as simple as "shutdown -h now" to more complex package management stuff.

I want my program to be platform independent and as some distributions do not use sudo, and some users simply don't like sudo, I want to make it work without it.

I also want some commands to work without me having to su to root or use sudo.

With the example of the shutdown command - is there any way to make it useable by non root users?

Cheers

My first reaction, No. This would be a major security flaw. Keep in mind I did no research into this topic before posting. That Is just my initial thought.

[Prometheum]

What language is this in?

This might be more appropriate for Hello World, but if you're in C, I'm sure there's a library function you can call to elevate your privileges. That will require user input; if you want your program to be autonomous, you pretty much have to use the setuid bit on it and have it run as root no matter who starts it.

[deus-redux]

You can set the file permissions with the setuid bit (as root, chmod +s on your executable). You also need to make sure it's owned by root (chown root) and everyone else has exec permissions (chmod a+x).

Please be aware of the security implications though. If you leave the file editable by everyone, they can potentially modify it and run whatever they wish as root.

It's really far safer if you can, to prompt the user to su to root. These permission differences exist for a reason, after all.

The other thing is, as far as I can tell, setuid affects the initial file that is executed - so if it's a binary, that's fine... but running a PHP script, seems not to give the root permissions to PHP... not sure if anyone knows a workaround to this?

-deus-

[Dazzle]

Originally Posted by glitched

My first reaction, No. This would be a major security flaw. Keep in mind I did no research into this topic before posting. That Is just my initial thought.

Yeah, that's what I thought at first. The thing is, it would be set up by root so that other users can use it. So it's like root would have to agree to allow other users to use it (just like sudo, really).. not really a security flaw, just a risk any system administrator would take with sudo anyway...

I thought about changing the file permissions for the configuration files... will changing them for the executables (in /usr/(s)bin IIRC) make for example "shutdown" work?

Prom: writing it in python... recently discovered the "import subprocess" command, I'm having fun with it XD

[Prometheum]

Originally Posted by Dazzle

Yeah, that's what I thought at first. The thing is, it would be set up by root so that other users can use it. So it's like root would have to agree to allow other users to use it (just like sudo, really).. not really a security flaw, just a risk any system administrator would take with sudo anyway...

I thought about changing the file permissions for the configuration files... will changing them for the executables (in /usr/(s)bin IIRC) make for example "shutdown" work?

Prom: writing it in python... recently discovered the "import subprocess" command, I'm having fun with it XD

Sounds like you want to use setuid. Note that you'll only be able to take advantage of it if you execute the script directly with something like /path/to/script, you will not get root with something like python /path/to/script.

[deus-redux]

Originally Posted by Dazzle

I thought about changing the file permissions for the configuration files... will changing them for the executables (in /usr/(s)bin IIRC) make for example "shutdown" work?

To be honest, I would really avoid changing the permissions on config files and system binaries unless you really know what you're doing.

Originally Posted by Dazzle

Prom: writing it in python... recently discovered the "import subprocess" command, I'm having fun with it XD

You're gonna fall foul of not being able to use setuid properly with scripting, then.

You could potentially write a setuid'd binary as a wrapper to execute the script. Do you know enough C to do this?

-deus-

[deus-redux]

Originally Posted by Prometheum

Sounds like you want to use setuid. Note that you'll only be able to take advantage of it if you execute the script directly with something like /path/to/script, you will not get root with something like python /path/to/script.

I don't think most systems honor setuid for scripting, even if it's done with a shebang line. At least mine won't. It would make sense, since the binary that gets run is still Python, which isn't setuid'd.

edit:

Apparently Perl does have some kind of workaround for this. No idea if Python has something similar.

http://www.dwheeler.com/secure-progr...id-setuid.html

-deus-

[Prometheum]

Originally Posted by deus-redux

I don't think most systems honor setuid for scripting, even if it's done with a shebang line. At least mine won't. It would make sense, since the binary that gets run is still Python, which isn't setuid'd.

edit:

Apparently Perl does have some kind of workaround for this. No idea if Python has something similar.

http://www.dwheeler.com/secure-progr...id-setuid.html

-deus-

It's always worked for me, but I guess that's because I only use perl and shell scripts. You could just have a shell script running as suid and have that call the python script.

[Dazzle]

So one of the ways around it would be to use C or perl, neither of which I am at all familiar with...

The more I read about programming, the more I think I should learn C... it seems the be the fastest, most versatile language out there, albeit definitely not the simplest...

Slightly off topic, but in general (not just for this task): Do you think C (or maybe C++) would be more valuable than perl?

About the shell script: wouldn't you have to run the shell script as root in the first place? or just create it as root?

[deus-redux]

Originally Posted by Dazzle

The more I read about programming, the more I think I should learn C... it seems the be the fastest, most versatile language out there, albeit definitely not the simplest...


Slightly off topic, but in general (not just for this task): Do you think C (or maybe C++) would be more valuable than perl?

C is one of my favorite languages, and it's pretty much the backbone of *nix.

That said, Perl can also be very valuable.

I would really try and learn C now if you have the time. It's well worth it. Try and pick up Perl later if you get the chance. Once you know C, learning Perl should come easily.

Originally Posted by Dazzle

About the shell script: wouldn't you have to run the shell script as root in the first place? or just create it as root?

Try it on your system. Create a shell script that tries to do something only root can (create a file in root's home directory, for example).

su to root, chown the file to root:root. chmod a+x it, so all users can run it. chmod +s it, to set setuid. Return to your normal user, and execute.

setuid should mean the script runs with the permissions of root.

Now for me, this works fine for a binary executable, but not a shell script. I've looked into it, and the consensus seems to follow this:

http://rob.sun3.org/misc/setgid-and-...shell-scripts/

-deus-

Could this be solved by creating a new group, adding the users, and giving execute permission to members of the group?

[coroner]

Originally Posted by beatmeofficer

Could this be solved by creating a new group, adding the users, and giving execute permission to members of the group?

You would think you could manipulate something using the wheel group, since wheel is in root's group. Unfortunately since Linux kernel does not let you use setuid or setgid on shell scripts as you would an ELF executable, then you simply cannot do this. What he should do is create a specialized group and put his users in that group, for example, autopsy and coroner on my laptop are in the "users" group. All I have to do is put the "users" group in the sudoers file, and require no password for any command, or I can specify which commands specifically with the full file path. No need to specify each user since sudoers allows specification by group and specific commands.

That is what he should do if using BASH.