Compare what happens with a shell script either being executed directly or as an argument to /bin/sh: 

$ cat script.sh 
  #!/bin/sh
  echo it ran
$ ls -l
  ---------- 1 david david 22 2013-11-11 11:38 script.sh

$ ./script.sh
  bash: ./script.sh: Permission denied
$ sh ./script.sh
  bash: script.sh: Permission denied

[download]

and as root ... 

# ./script.sh
  -su: ./script.sh: Permission denied
#  sh script.sh
  it ran

[download]

Now, obviously you don't have permission to do anything with the script if you are an ordinary user, so everything happens as you expect.

However, if you are root, then things get a bit more complicated. When you attempt to execute something using the magic '#!' line, the system only looks for that if the file is marked as being executable by you. Even if you're root, if none of the 'x' bits are set then it won't execute like this

But if you provide the script's name as an argument to an interpreter yourself, then the system looks to see if the interpreter (/bin/sh, or /usr/bin/perl, for example) has an 'x' bit set that applies to you. If it does, then the interpreter gets executed. It looks at its arguments, finds a filename, checks to see if the file is readable and then does its thang with it. Note that if you're root, a file with mode 0 is still readable, so the interpreter successfully opens it, reads the contents, and executes them.

So no, this isn't a security hole. It's just an artifact of what the 'execute' permission bits mean and how they are interpreted.

In reply to Re: perl executes mode 0 argument passed script when called through sudo, security hole? by DrHyde
in thread perl executes mode 0 argument passed script when called through sudo, security hole? by Don Coyote

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.