Running root commands without sudo

[Dazzle]

I am currently writing a program for a series of system related configuration, which involves a lot of messing around with programs that require root access. However, I do not wish to use sudo in order to be able to use these commands, as simple as "shutdown -h now" to more complex package management stuff.

I want my program to be platform independent and as some distributions do not use sudo, and some users simply don't like sudo, I want to make it work without it.

I also want some commands to work without me having to su to root or use sudo.

With the example of the shutdown command - is there any way to make it useable by non root users?

Cheers

[glitched]

My first reaction, No. This would be a major security flaw. Keep in mind I did no research into this topic before posting. That Is just my initial thought.

[Prometheum]

What language is this in?

This might be more appropriate for Hello World, but if you're in C, I'm sure there's a library function you can call to elevate your privileges. That will require user input; if you want your program to be autonomous, you pretty much have to use the setuid bit on it and have it run as root no matter who starts it.

[deus-redux]

You can set the file permissions with the setuid bit (as root, chmod +s on your executable). You also need to make sure it's owned by root (chown root) and everyone else has exec permissions (chmod a+x).

Please be aware of the security implications though. If you leave the file editable by everyone, they can potentially modify it and run whatever they wish as root.

It's really far safer if you can, to prompt the user to su to root. These permission differences exist for a reason, after all.

The other thing is, as far as I can tell, setuid affects the initial file that is executed - so if it's a binary, that's fine... but running a PHP script, seems not to give the root permissions to PHP... not sure if anyone knows a workaround to this?

-deus-

[Dazzle]

Originally Posted by glitched

My first reaction, No. This would be a major security flaw. Keep in mind I did no research into this topic before posting. That Is just my initial thought.

Yeah, that's what I thought at first. The thing is, it would be set up by root so that other users can use it. So it's like root would have to agree to allow other users to use it (just like sudo, really).. not really a security flaw, just a risk any system administrator would take with sudo anyway...

I thought about changing the file permissions for the configuration files... will changing them for the executables (in /usr/(s)bin IIRC) make for example "shutdown" work?

Prom: writing it in python... recently discovered the "import subprocess" command, I'm having fun with it XD

[Prometheum]

Originally Posted by Dazzle

Yeah, that's what I thought at first. The thing is, it would be set up by root so that other users can use it. So it's like root would have to agree to allow other users to use it (just like sudo, really).. not really a security flaw, just a risk any system administrator would take with sudo anyway...

I thought about changing the file permissions for the configuration files... will changing them for the executables (in /usr/(s)bin IIRC) make for example "shutdown" work?

Prom: writing it in python... recently discovered the "import subprocess" command, I'm having fun with it XD

Sounds like you want to use setuid. Note that you'll only be able to take advantage of it if you execute the script directly with something like /path/to/script, you will not get root with something like python /path/to/script.

[deus-redux]

Originally Posted by Dazzle

I thought about changing the file permissions for the configuration files... will changing them for the executables (in /usr/(s)bin IIRC) make for example "shutdown" work?

To be honest, I would really avoid changing the permissions on config files and system binaries unless you really know what you're doing.

Originally Posted by Dazzle

Prom: writing it in python... recently discovered the "import subprocess" command, I'm having fun with it XD

You're gonna fall foul of not being able to use setuid properly with scripting, then.

You could potentially write a setuid'd binary as a wrapper to execute the script. Do you know enough C to do this?

-deus-

[deus-redux]

Originally Posted by Prometheum

Sounds like you want to use setuid. Note that you'll only be able to take advantage of it if you execute the script directly with something like /path/to/script, you will not get root with something like python /path/to/script.

I don't think most systems honor setuid for scripting, even if it's done with a shebang line. At least mine won't. It would make sense, since the binary that gets run is still Python, which isn't setuid'd.

edit:

Apparently Perl does have some kind of workaround for this. No idea if Python has something similar.

http://www.dwheeler.com/secure-progr...id-setuid.html

-deus-

[Prometheum]

Originally Posted by deus-redux

I don't think most systems honor setuid for scripting, even if it's done with a shebang line. At least mine won't. It would make sense, since the binary that gets run is still Python, which isn't setuid'd.

edit:

Apparently Perl does have some kind of workaround for this. No idea if Python has something similar.

http://www.dwheeler.com/secure-progr...id-setuid.html

-deus-

It's always worked for me, but I guess that's because I only use perl and shell scripts. You could just have a shell script running as suid and have that call the python script.

[Dazzle]

So one of the ways around it would be to use C or perl, neither of which I am at all familiar with...

The more I read about programming, the more I think I should learn C... it seems the be the fastest, most versatile language out there, albeit definitely not the simplest...

Slightly off topic, but in general (not just for this task): Do you think C (or maybe C++) would be more valuable than perl?

About the shell script: wouldn't you have to run the shell script as root in the first place? or just create it as root?