in reply to Re^4: Best way to write to a file owned by root?
in thread Best way to write to a file owned by root?

Thanks for the good info. This is interesting to think about. Fortunately, I'm just writing a script under my total control on my own local machine and does not have processes available to the public. Basically, it's just automating a task that I would do manually with sudo vim /etc/hosts command anyway. I'm trying to figure out how to do that with the least risk of breaking something. I *think* my code accomplished that because it makes a copy of the /etc/hosts file, makes the ownership and privileges changes to copy of the file and, if those are successful, only then copies the modified file back to /etc/hosts. Also, the file is read only only by my account so no one else can look at it.

$PM = "Perl Monk's";
$MCF = "Most Clueless Friar Abbot Bishop Pontiff Deacon Curate";
$nysus = $PM . ' ' . $MCF;
Click here if you love Perl Monks

Replies are listed 'Best First'.
Re^6: Best way to write to a file owned by root?
by afoken (Chancellor) on Mar 15, 2017 at 06:42 UTC
    I'm just writing a script under my total control on my own local machine and does not have processes available to the public.

    So it has no network connection? I don't think so.

    I *think* my code accomplished that because it makes a copy of the /etc/hosts file, makes the ownership and privileges changes to copy of the file and, if those are successful, only then copies the modified file back to /etc/hosts.

    Replace the last step with a rename. Rename is atomar, copy is not. And yes, rename will work for an existing file:

    /tmp>echo bla > one

/tmp>echo blubb > two

/tmp>mv two one

/tmp>cat one
blubb

/tmp>echo bla > one

/tmp>echo blubb > two

/tmp>perl -e 'rename "two","one" or die $!'

/tmp>cat one
blubb

/tmp>

    [download]
    Also, the file is read only only by my account so no one else can look at it.

    /etc/hosts should have mode 0644, not 0400 or 0600. Even if only you work with your computer, it still uses several different user accounts to do its job. And some of those user accounts need to resolve host names, i.e. read /etc/hosts. Even if they only need to resolve localhost to ::1 or 127.0.0.1.

    Alexander

    --
    Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)
[reply]
[d/l]

      I'm no security guru (clearly) so tell me if I'm wrong. Yes, it is true my local machine is connected to the Internet. But anyone who hacked my machine would need my account access to run or even read my script. If someone has hacked my machine with my user account, it seems like they are in a very good position of changing my /etc/hosts file without my script to help them. Right?

      My /etc/hosts file is 0644. I was saying my script that I use to automate the appending to /etc/hosts has perms of 700. Sorry for the confusion.

      $PM = "Perl Monk's";
      $MCF = "Most Clueless Friar Abbot Bishop Pontiff Deacon Curate";
      $nysus = $PM . ' ' . $MCF;
      Click here if you love Perl Monks

[reply]
        If someone has hacked my machine with my user account, it seems like they are in a very good position of changing my /etc/hosts file without my script to help them. Right?

        No. This is why we have different user accounts. Your user does not have write access to /etc/hosts and therefore anyone who compromises your account also lack the write access to that file. If you bypass that by some means in your script (sudo, setuid, whatever) then the attacker suddenly does have access to write to the previously protected file via your script.

        So don't do that.

[reply]
[d/l]

In Section Seekers of Perl Wisdom