Sudo: must be setuid root (Mac OS X)

mac-osxsetuidsudo

I ran

$ sudo chown -R $USER /usr/bin

and now when I try to run programs under the /usr/bin path as sudo I get

sudo:must be setuid root

What should I do if I would like to revert the chown?

Best Answer

Run Disk Utility, select your boot volume, and use "Repair Permissions". Since the files in /usr/bin (including sudo) were installed as part of the OS, it knows what their ownership and permissions should be, and it'll set them back properly.

Related Solutions

Security – sudo chown – prevent ../

sudo introduces inherent security risks and it is generally ill advised to give to users that don't have high levels of trust.

Why not limit simply to recursive chown for the parent directory?

sudoers primarily uses globbing. According to the manpage, it doesn't match / on wildcards. More details in the manpage.

As far as a more advanced solution, a script should do the trick.

[root@server wmoore]# egrep '^wmoore' /etc/sudoers
wmoore ALL= NOPASSWD: /bin/chown -[RPfchv] wmoore\:wmoore /home/wmoore/[a-zA-Z0-9]*

[wmoore@server ~]$ sudo -l
User wmoore may run the following commands on this host:
    (root) NOPASSWD: /bin/chown -[RPfchv] wmoore:wmoore /home/wmoore/[a-zA-Z0-9]*

[wmoore@server ~]$ sudo chown -R wmoore:wmoore /home/wmoore/../../tmp/test
Sorry, user wmoore is not allowed to execute '/bin/chown -R wmoore:wmoore /home/wmoore/../../tmp/test' as root on server.

Oh, right. sudo package:

Name        : sudo                         Relocations: (not relocatable)
Version     : 1.6.9p17                          Vendor: CentOS
Release     : 3.el5_3.1                     Build Date: Tue 24 Mar 2009 07:55:42 PM EDT

CentOS5.

Sudo or acl or setuid/setgid

Best practices: maintain the sudoers file and use sudo.

On my personal machine, I prefer setuid/gid, but I'm the only one on my computer; and I don't do it to anything blatantly dangerous like rm.

Best Answer

Related Solutions

Security – sudo chown – prevent ../

Sudo or acl or setuid/setgid

Related Topic