Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 4 down vote favorite

I have an executable created by my userid that I need to have run as root. Therefore I need to change the ownership of my executable to be root:root and use setuid. When I attempt

sudo chown root:root [EXE_NAME]

I get the error: 

chown: changing ownership of `[EXE_NAME]`: Operation not permitted

My constraints are:

  • I have sudo ALL ALL for my userid in the sudoers file, but cannot login as root
  • The executable that needs to run as root is attempting to bind to a network interface (hence the need to run as root) in promiscious mode using the pcap_open_live function.

Is there a better way to solve my ultimate problem, that is, needing to run an executable that binds to a network interface that is secure and does not require sudo or creating a root owned shell (sudo tcsh)

share|improve this question
Which OS are you using? BSD? OSX, GNU/Linux? – Hennes Sep 19 '12 at 22:10
GNU/Linux RHEL 6.2 – cacopela Sep 19 '12 at 22:16
See @Dennis's answer: if the file is on a filesystem that doesn't support ownership (like vfat or smb), then you can't change it. – Stefan Seidel Sep 20 '12 at 12:47

4 Answers

up vote 2 down vote

If sudo actually gives you UID 0 (check with sudo id) I'd suspect that the file reside on a filesystem that doesn't support permissions (e.g. FAT32). On such a filesystem you cannot change ownership (or permissions) of a file.

share|improve this answer
sudo id gives UID 0. How would I check the filesystem that the exe resides on? (It is a net mount, I believe) – cacopela Sep 19 '12 at 22:18
mount will list all mounted filesystems including their type. If it's a network-mounted filesystem, it's possible that root doesn't have write access to that filesystem (e.g. an NFS mount with root_squash enabled). – Ansgar Wiechers Sep 19 '12 at 22:21
How do I tell if root_squash is enabled. Here is the output from mount /home/sw/ type nfs (rw,sloppy,addr=XXX.XXX.XXX.XXX) The IP is actually specified, I just figure its not relevant. – cacopela Sep 19 '12 at 22:40
You take a look at /etc/exports on the NFS server. If the exported filesystem does not have the option no_root_squash set, then root sqashing is enabled (i.e. root is mapped to another account, usually nobody). – Ansgar Wiechers Sep 19 '12 at 23:04
thanks for your help. I'll see what I can find out. – cacopela Sep 19 '12 at 23:05
up vote 1 down vote

If your file system supports ownership, there are three more reasons I can think of:

  1. The partition is mounted read-only.

    Try renaming the file or creating another file in the same directory. If you can, that's not the problem.

  2. The file is locked.

    Check if the program is running. Try renaming the file.

  3. The file is set as append only or immutable.

    To change this, execute the following command:

    sudo chattr -ai filename
share|improve this answer
Item 1 and 2. Check able to rename the file. Item 3: lsattr [EXE_NAME] gives error: lsattr: Inappropriate ioctl for device While reading flags on [EXE_NAME] – cacopela Sep 19 '12 at 22:39
If the filesystem were mounted read-only, chown would report Read-only file system. – Ansgar Wiechers Sep 19 '12 at 23:23
up vote 0 down vote

If you just need to change ownership (and not ownership and the group) then you can use chown root filename. Prefixed by sudo if you are not root.

If you also want to change the group there is always chgrp.

(Granted, not as nice as all in a single command).

share|improve this answer
sudo chown root filename as you suggest produces the same error – cacopela Sep 19 '12 at 22:03
2  
@Hennes: chown root:root filename changes both owner and group. – Dennis Sep 19 '12 at 22:12
Aye. But I just tried that as root and I got an error for chown root:root filename but not on chown root filename. (This was as root on a FFS filesystem on FreeBSD 7). – Hennes Sep 19 '12 at 22:55
up vote 0 down vote

Normal users can also bind to a network interface, just not to ports under 1024. Thus, you could have your program bind to a port >= 1024 and then redirect to that port either externally or via ssh -fN -L 0.0.0.0:<PRIV_PORT>:localhost:<UNPRIV_PORT>.

That being said, your problem could also relate to SElinux, which is enabled by default in RHEL. To disable it, set SELINUX=disabled in /etc/selinux/config.

share|improve this answer
I am binding to a port greater than 1024 and SELINUX is disabled. – cacopela Sep 20 '12 at 16:46
So there's no need to run as root, or is there? If you can run nc -l <PORTNUM> without problems, then all should be fine and you don't need to run the program as root. – Stefan Seidel Sep 20 '12 at 18:38
the issue is using pcap to monitor the traffic on a device, using pcap_open_live in promiscious mode. When not ran as root: I receive the message: `eth0: You don't have permission to capture on that device (socket: Operation not permitted)' – cacopela Sep 20 '12 at 19:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.