1

So I recently went through the wonderful adventure of fixing the /usr/bin/sudo file after it's permissions have been changed. This was on a system where it had been intentionally reconfigured to make it difficult obtain root through the other normal routes.

Now to prevent this in the future, I could just run these commands on a root cron job:

chown root:root /usr/bin/sudo
chmod 4755 /usr/bin/sudo

However, ideally this set of commands would not only fix the sudo file, but all the files needed for an effective root.

My Question: Is there an existing script or library I can install to make sure effective root is maintained?

 

This is for Fedora 26 running on VM.

4
  • As a side note, I am aware that I also now get to go on yet another wonderful adventure where I get to research what other files in /usr/bin have special permissions that now need to be fixed. Oct 11, 2017 at 15:12
  • You shouldn't ever need to do this. By default the only person who can remove root's permissions, is root. You have a far bigger issue if people are changing the permissions on the file system as root, if they aren't meant to be. Oct 11, 2017 at 15:12
  • I was the one who made the mistake, I just didn't realize until after I had logged out of root. Oct 11, 2017 at 15:22
  • @NicholasSummers I have seen the question in the past for fixing screwed up root permissions and the consensus was reinstall or restore from backup. With images available, his should not really be a big deal. Also the consensus would elude to their NOT being a script you seek.
    – Damon
    Oct 12, 2017 at 3:03

1 Answer 1

2

You an reset all of the permissions and user/group ownership of an RPM with rpm, using --setperms and --setugids, respectively.

So, from the command line, run:

$ sudo rpm --setperms -a
$ sudo rpm --setugids -a

Or you could drop a script running these into /etc/cron.daily — but it seems extraordinary that you would need that. Instead, be a little more careful when running as root (and use rescue boot media if you happen to ever make this mistake in the future).

4
  • As far as I am understanding it this isn't quite what I am looking for. The big concern here is file permissions/ownership on Fedora's root level binaries. Unless this will fix those too? Oct 12, 2017 at 18:29
  • Also, the cron portion would mostly be to check perms. I was planning on making the script available as service running as root at startup. The service would strictly use predefined commands, so no user would be able issue their own commands, but any user could apply a fix. Oct 12, 2017 at 18:33
  • @NicholasSummers This will fix permissions on all binaries installed as packages (that is, all software provided by Fedora). I don't know exactly what you mean by "root level binaries", but /usr/bin/sudo would, for example, be clouded.
    – mattdm
    Oct 12, 2017 at 19:28
  • 1
    I more or less mean files that require special permissions like 4755. In any case, this answer is pretty much what I am looking for. Oct 13, 2017 at 18:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .