Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm on OSX 10.8.

Before my experiment it's like this:

Nathan-der-Graue:~ max$ ls -l /bin/bash
-r-xr-xr-x  1 root  wheel  1333920 17 Feb 15:22 /bin/bash

Then I run

Nathan-der-Graue:~ max$ sudo chmod +s /bin/bash

I expected this to make bash always come up as a root shell, but it seems that it didn't change anything to bash's behaviour:

Nathan-der-Graue:~ max$ /bin/bash
bash-3.2$ whoami
max

I know this isn't a good idea at all. Where is my mistake? I guess I have misunderstood the +s-flag.

share|improve this question
    
Making /bin/bash setuid is likely to break parts of OS X itself, because it's used for a variety of scripts within the OS, some of which should not run as root. If you want a setuid shell, give it a different name to avoid conflicts. –  Gordon Davisson Mar 1 '13 at 15:33

2 Answers 2

up vote 3 down vote accepted

It does not work because bash explicitly checks for the "running setuid" case, and sets its EUID to be the same as the RUID – in other words, it drops all privileges it might have gained from the setuid bit.


Processes have several separate UIDs – the two primary ones are the RUID (real UID, often just "UID"), which determines who owns the process, and the EUID (effective UID), which determines the privileges that process has.

When the EUID is 0 (root), the process can set any RUID or EUID it wants; and if the process doesn't have root privileges, it can still set its RUID to be the same as the EUID or vice versa.

When the setuid bit is set, it affects only the new process' EUID, not RUID – in other words, it only gives the file owner's privileges, not the identity. Try it again with /usr/bin/id.

share|improve this answer
    
So, I didn't get it wrong, it's just that bash behaves in a special way to prevent this? Is there any other way to achieve my wanted scenario? –  Max Ried Mar 1 '13 at 14:02
1  
@MaxRied: Write a small C program that sets the RUID to the EUID before starting bash. #include <unistd.h> /*newline*/ int main(int argc, char *argv[]) { setgid(getegid()); setuid(geteuid()); argv[0] = "bash"; execvp(argv[0], argv); } –  grawity Mar 1 '13 at 14:13

If you have sudo privileges, you can run

sudo -s

to get a root shell.

share|improve this answer
    
Any particular reason for the downvote? –  chepner Mar 1 '13 at 16:23
1  
I suspect it is because you did not answer the question. The question is "Why did setuid_bash not work. Did I misunderstand the s-bit." It is not "how do I get a root shell". –  Hennes Mar 1 '13 at 16:56
1  
True, I made the (unwarranted?) assumption that this was an XY problem, and he just wanted to have a root shell. –  chepner Mar 1 '13 at 17:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.