SUID?

Punto has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: SUID? by arhuman (Vicar) on Jan 24, 2001 at 13:59 UTC
Yes you're right a SUID script/prog is executed with the execution right of the owner of the file (not the one who execute the file... a SUID root script (a script own by root and with the SUID bit set) will execute with root rights... BTW: I say script but it could be a shell-script,a perl script or an executable (c compiled prog)... Note also that some OS disable SUID script execution for several security reasons (race condition,IFS modification and incorrect input handling (among other things) lead to several security risks...) To know more on this with perl : `perldoc perlsec` (look especially for suidperl) To know more on SUID scripts/prog security : Any security related site... (<self-promotion>checksum.org by example </self-promotion>)	[reply] [d/l]
Re: SUID? by zigster (Hermit) on Jan 24, 2001 at 14:05 UTC
A suid or set uid program/script is an executable that has the setuid bit set via chmod +s binary name see chmod(1). The setuid bit will mean that when the program runs it will change its 'effective' user id to the user that 'owns' the file on the file system see chown(1). The running binary will aquire the permissions of that user. So if root 'owns' the file (see chmod) then yes when the binary runs then it will get root permissions, if however fred owns the setuid binary then when it runs it will have freds permissions. Thre is also a setgid (set group id) this does exactly what you would expect from the definition of setuid. The setuid/setgid bit has different meanings if set to non-executable files check out the manual page for chmod for more details. HTH. -- Zigster	[reply]
Re: SUID? by tye (Sage) on Jan 24, 2001 at 19:04 UTC
What is a SUID script? [...] how do I use that with perl? Perhaps a good answer is "If you have to ask then you don't (use one)". Don't get me wrong, it is fine to ask. But you need to get a much, much deeper understanding of the concept before you want to actually start using it. Otherwise you are likely to create a big security hole that may allow your system to be "compromised". Your first question has been answered already (to some extent -- read the referenced documentation for more info). I just felt you deserved a good "heads up" warning. (: - tye (but my friends call me "Tye")	[reply]