Running root commands without sudo

[deus-redux]

Originally Posted by Dazzle

The more I read about programming, the more I think I should learn C... it seems the be the fastest, most versatile language out there, albeit definitely not the simplest...


Slightly off topic, but in general (not just for this task): Do you think C (or maybe C++) would be more valuable than perl?

C is one of my favorite languages, and it's pretty much the backbone of *nix.

That said, Perl can also be very valuable.

I would really try and learn C now if you have the time. It's well worth it. Try and pick up Perl later if you get the chance. Once you know C, learning Perl should come easily.

Originally Posted by Dazzle

About the shell script: wouldn't you have to run the shell script as root in the first place? or just create it as root?

Try it on your system. Create a shell script that tries to do something only root can (create a file in root's home directory, for example).

su to root, chown the file to root:root. chmod a+x it, so all users can run it. chmod +s it, to set setuid. Return to your normal user, and execute.

setuid should mean the script runs with the permissions of root.

Now for me, this works fine for a binary executable, but not a shell script. I've looked into it, and the consensus seems to follow this:

http://rob.sun3.org/misc/setgid-and-...shell-scripts/

-deus-

[beatmeofficer]

Could this be solved by creating a new group, adding the users, and giving execute permission to members of the group?

[coroner]

Originally Posted by beatmeofficer

Could this be solved by creating a new group, adding the users, and giving execute permission to members of the group?

You would think you could manipulate something using the wheel group, since wheel is in root's group. Unfortunately since Linux kernel does not let you use setuid or setgid on shell scripts as you would an ELF executable, then you simply cannot do this. What he should do is create a specialized group and put his users in that group, for example, autopsy and coroner on my laptop are in the "users" group. All I have to do is put the "users" group in the sudoers file, and require no password for any command, or I can specify which commands specifically with the full file path. No need to specify each user since sudoers allows specification by group and specific commands.

That is what he should do if using BASH.