6

I have an embedded Linux running on a imx6 platform. This is a freescale embedded linux. The problem is that there is no sudo available for this linux, but I need to activate and deactivate the wlan0 device by a user. I tried to add the user to the group root without any success. I also tried to add the whole command to the /etc/busybox.conf file, but this had no effect either.

How can I run this command as user without having sudo?

user@touch:~$ /sbin/ifconfig eth0 down
SIOCSIFFLAGS: Permission denied
4
  • Can you use suto become root?
    – jcbermu
    Jan 28, 2015 at 9:48
  • 1
    Running ifconfig outside root permissions is a security risk. Edit your sudoers file so you are allowed to sudo ifconfig.
    – agtoever
    Jan 28, 2015 at 9:56
  • Why don't you make an answer of your comments?
    – nlu
    Jan 28, 2015 at 21:12
  • @nlu The question is already answered for me. See answer. Jan 29, 2015 at 6:12

3 Answers 3

5

If any non root user would be trusted to do so, you can merely add a setuid flag on ifconfig exec:

chmod 4755 /sbin/ifconfig

It will grant root privilege for execution of this executable to anyone. Of course, you need to have root access to run the chmod.

1
  • 1
    Doing this is a serious security risk. It opens up tampering with your network traffic, even to the users visiting you website. A reverse shell exploit willl then expose all network traffic to the attacker.
    – agtoever
    Jan 28, 2015 at 9:59
8

You don't need to use sudo to run the ifconfig command, just make sure that the /sbin is on your PATH .

as an unprivileged user run:

export PATH=$PATH:/sbin
ifconfig
2
  • 2
    this isn't related to what the OP asked. Running /sbin/ifconfig is exactly the same as running ifconfig with /sbin in the path
    – phuclv
    Jun 12, 2017 at 2:40
  • 2
    @LưuVĩnhPhúc Right , you will be able to read the ouput of the ifconfig command ; the /sbin/ifconfig will work but the write access will be denied e,g: /sbin/ifconfig wlan0 down will not work
    – GAD3R
    Jun 12, 2017 at 8:45
1
  1. For new Linux users; the package sudo gives a non-priveleged user a preset number of minutes to do things to the system that only the System Administrator ('root' == 'uid=0') can do.

  2. The program ifconfig has a lot of security issues associated with it for Linux operating systems that are on public facing servers. For desktop and home servers that have KVM connections, don't require SSH access and don't want 24/7 internet connectivity, this program has lower security requirements.

  3. ifconfig is protected by another program called netdevice. This program provides low level access to Linux network devices. See man netdevice. The error that was thrown SIOCSIFFLAGS: Permission denied is because the program ifconfig is marked as privileged and requires an effective user ID of 0 ('root' <==> 'uid=0') or the CAP_NET_ADMIN capability. If this is not the case, EPERM will be returned.

  4. In order to find out what CAP_NET_ADMIN is we have to read capabilities(7) — Linux manual page. The important info here is "CAP_NET_ADMIN: Perform various network-related operations such as interface configuration". In order to find out what EPERM is we have to read man setuid. The EPERM error is thrown when the user is not privileged (Linux: does not have the CAP_SETUID capability) AND uid does not match the real UID or saved set-user-ID of the calling process.

  5. It is not possible to simply add your 'username' to the group 'root'. Example for Ubuntu distros: sudo adduser username root will not give you the necessary UID of 0 in order to pass all the security checks that netdevice demands. If visudo is available on the system one can see that the entry Defaults secure_path="" does not include a path to the program netdevice.h. So it is unlikely that modifying the sudo permissions (using visudo) for the ifconfig program will result in bypassing the security control provided by netdevice.

Assuming your not running a public server, the answer supplied by @tonioc is the easiest way to turn on and off the interfaces of a Linux distribution (such as Ubuntu that automatically enables all ethernet interfaces after a reboot) without using sudo privileges. The sudo chmod 4755 /sbin/ifconfig command is a simple way to modify your system such that a startup script such as ifconfig eth0 down can turn OFF an interface (without entering a password). For desktops/servers that have both intranet and internet networks attached (multi-NIC) it is critical for security that the internet networks remain OFF when they are not needed.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .