0

So I recently went through the wonderful adventure of fixing the /usr/bin/sudo file after it's permissions have been changed. This was on a system where it had been intentionally reconfigured to make it difficult obtain root through the other normal routes.

Now to prevent this in the future, I could just run these commands on a root cron job:

chown root:root /usr/bin/sudo
chmod 4755 /usr/bin/sudo

However, ideally this set of commands would not only fix the sudo file, but all the files needed for an effective root.

My Question: Is there an existing script or library I can install to make sure effective root is maintained?

 

This is for Fedora 26 running on VM.

  • As a side note, I am aware that I also now get to go on yet another wonderful adventure where I get to research what other files in /usr/bin have special permissions that now need to be fixed. – Nicholas Summers Oct 11 '17 at 15:12
  • You shouldn't ever need to do this. By default the only person who can remove root's permissions, is root. You have a far bigger issue if people are changing the permissions on the file system as root, if they aren't meant to be. – djsmiley2k Oct 11 '17 at 15:12
  • I was the one who made the mistake, I just didn't realize until after I had logged out of root. – Nicholas Summers Oct 11 '17 at 15:22
  • @NicholasSummers I have seen the question in the past for fixing screwed up root permissions and the consensus was reinstall or restore from backup. With images available, his should not really be a big deal. Also the consensus would elude to their NOT being a script you seek. – Damon Oct 12 '17 at 3:03
1

You an reset all of the permissions and user/group ownership of an RPM with rpm, using --setperms and --setugids, respectively.

So, from the command line, run:

$ sudo rpm --setperms -a
$ sudo rpm --setugids -a

Or you could drop a script running these into /etc/cron.daily — but it seems extraordinary that you would need that. Instead, be a little more careful when running as root (and use rescue boot media if you happen to ever make this mistake in the future).

  • As far as I am understanding it this isn't quite what I am looking for. The big concern here is file permissions/ownership on Fedora's root level binaries. Unless this will fix those too? – Nicholas Summers Oct 12 '17 at 18:29
  • Also, the cron portion would mostly be to check perms. I was planning on making the script available as service running as root at startup. The service would strictly use predefined commands, so no user would be able issue their own commands, but any user could apply a fix. – Nicholas Summers Oct 12 '17 at 18:33
  • @NicholasSummers This will fix permissions on all binaries installed as packages (that is, all software provided by Fedora). I don't know exactly what you mean by "root level binaries", but /usr/bin/sudo would, for example, be clouded. – mattdm Oct 12 '17 at 19:28
  • 1
    I more or less mean files that require special permissions like 4755. In any case, this answer is pretty much what I am looking for. – Nicholas Summers Oct 13 '17 at 18:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.