Run binary automatically as root

permissionsrootsudo

I have root access.

How can I let a general user with little permissions run a binary file as root without a password?

I tried giving it root:wheel with chown, but that did not let a general user do what I wanted.

Best Answer

chown changes the owner, it doesn't make the binary run as the file owner. chmod u+s will do that however. chmod g+s will make the binary run with the file group permission on some systems as well (you don't mention what system you're running). These flags have very different effects on other files and especially folders. You should take a good long look at man chmod and man chown before diving in.

Also you should strongly consider using sudo instead of making the binary suid. When a binary is suid, anyone who can access the binary can run it as the file's owner. If you accidentally give a normal user write permissions to the binary, then they could replace it with anything that want and run it as root. sudo solves these security problems at the cost of requiring the user to prepend sudo to commands they want to run as root. You also have to setup the sodoers file with approproiate permissions.

Related Solutions

Linux Security – Allow One User to su to Another Without Root Access

Yes, this is possible.

In /etc/sudoers the item immediately following the equals is the user that the command will be allowed to execute as.

tom  ALL=(oracle) /bin/chown tom *

The user (tom) can type sudo -u oracle /bin/chown tom /home/oracle/oraclefile

Linux – Risks of Always Being Root

If you're logged in as root, you can easily wipe directories or do something that in retrospect is really dumb on the system with the flip of a finger, while as a user you normally have to put a few extra mental cycles into what you're typing before doing something that is dangerous.

Also any program you run as root as root privileges, meaning if someone or something gets you to run/compile/browse a website that is dangerous and wants to damage your system, such as a trojan or other malware, it has full access to your system and can do what it wants, including access to TCP ports below 1024 (so it can turn your system into a remailer without your knowledge, for example).

Basically you're kind of asking for trouble that logging in as yourself may prevent. I've known many people that ended up being glad they had that safety net in a moment of carelessness.

EDIT: There is also the issue of root being the most well known, thus an easy target, for scripts and hacks. Systems that disable the account and instead force users to use sudo means that any attempt to crack root from ssh or a local exploit to the account are banging their heads against a wall. They'd have to guess/crack a password and username. It's security through obscurity to a degree but it's hard to argue that it doesn't foil most script kiddie attacks.

Best Answer

Related Solutions

Linux Security – Allow One User to su to Another Without Root Access

Linux – Risks of Always Being Root

Related Topic