Linux Tutorial
Linux File/Directory Management
Linux Packaging And Compression
Vim Text Editor
Linux Text Processing
Linux Software Installation
Linux User/User Group Management
Linux Permission Management
Linux Filesystem Management
Linux Advanced Filesystem Management
Linux System Management
Linux Backup and Recovery
Linux System Service Management
Linux System Log Management
Linux Boot Management
LAMP/LNMP Environment
SELinux Management
In this tutorial, we will explain the SetUID (SUID) special permission in Linux and how to use it. The SetUID permission allows a user to execute a file with the permissions of the file's owner, instead of the user who runs the command.
This special permission is useful in situations where certain programs need elevated privileges to execute their tasks, such as changing passwords or running privileged commands, without giving users full root access.
Understanding SetUID Permission
In Linux, each file and directory has three sets of permissions: user (owner), group, and others (world). These permissions determine who can read, write, or execute a file.
The SetUID permission is denoted by an s in the user (owner) permissions section of the file listing, as shown below:
-rwsr-xr-x 1 root root 12345 Jan 1 12:34 file_with_suid
In this example, the file file_with_suid has the SetUID permission enabled.
Setting SetUID Permission
To set the SetUID permission on a file, use the chmod command with the u+s option:
chmod u+s filename
Replace filename with the name of the file you want to set the SetUID permission on.
For example, to set the SetUID permission on a file named privileged_command:
chmod u+s privileged_command
Removing SetUID Permission
To remove the SetUID permission from a file, use the chmod command with the u-s option:
chmod u-s filename
Replace filename with the name of the file you want to remove the SetUID permission from.
For example, to remove the SetUID permission from a file named privileged_command:
chmod u-s privileged_command
Examples of SetUID Permission in Practice
A common example of SetUID permission in practice is the /usr/bin/passwd command, which allows users to change their passwords. The passwd command needs to access and modify the /etc/shadow file, which is owned by the root user and not writable by regular users.
By setting the SetUID permission on the passwd command, users can change their passwords without requiring full root access:
-rwsr-xr-x 1 root root 59640 Sep 1 2021 /usr/bin/passwd
Security Considerations
While SetUID permissions can be useful for certain tasks, they can also introduce security risks. When a user executes a SetUID-enabled file, they temporarily gain the privileges of the file's owner, which could be exploited for unauthorized access or malicious actions.
For this reason, you should only set the SetUID permission on trusted files and restrict write access to those files. Keep in mind that you should use SetUID judiciously and only when necessary.
Summary
The SetUID (SUID) special permission in Linux allows users to execute files with the permissions of the file's owner, rather than their own permissions. This can be useful for tasks that require elevated privileges without giving users full root access. However, using SetUID permissions can introduce security risks, so it should be used cautiously and only when necessary.
How to set SUID on a file in Linux:
# Example: Setting SUID on a file chmod u+s filename
Setting SUID on shell scripts in Linux:
# Example: Setting SUID on a shell script chmod u+s script.sh
Examples of using SUID for privilege escalation:
# Example: Exploiting SUID for privilege escalation ./elevated_program
Viewing SUID status with ls command in Linux:
ls command can be used to view the SUID status of a file. An 's' in the user permission field indicates SUID.# Example: Viewing SUID status ls -l filename
Troubleshooting SUID permission issues in Linux:
# Example: Checking SUID status ls -l filename # Review logs for permission issues tail -f /var/log/syslog