Gourt Home::Gourt :: Setuid
Setuid and setgid are Unix terms, which are short for "Set User ID" and "Set Group ID", respectively. Setuid, also sometimes referred to as "suid", and setgid are access right flags that can be assigned to files and directories on a Unix based operating system. They are mostly used to allow users on a computer system to execute binary executables with temporarily elevated privileges in order to perform a specific task.
Setuid and setgid are needed for tasks that require higher privileges than those which a common user has, such as changing his or her login password. Some of the tasks that require elevated privilege may not immediately be obvious, though -- such as the ping command, which must send and listen for control packets on a network interface.
Setuid on executables
When a binary executable file has been given the setuid attribute, normal users on the system can execute this file and gain the privileges of the user who owns the file (commonly root) within the created process. When root privileges have been gained within the process, the application can then perform tasks on the system that regular users normally would be restricted from doing. The invoking user will be prohibited by the system from altering the new process in any way, such as by using ptrace, LD_LIBRARY_PATH or sending signals to it (signals from the terminal will still be accepted, however).
While the setuid feature is very useful in many cases, it can however pose a security risk if the setuid attribute is assigned to executable programs that are not carefully designed. Users can exploit vulnerabilities in flawed programs to gain permanent elevated privileges, or unintentionally execute a trojan horse program.
The setgid attribute will allow for changing the group based privileges within a process, like the setuid flag does for user based privileges.
Demonstration
$ cat print_id.c
#include
#include
#include
#include
int main(void)
{
printf("Real UID\t= %d\n", getuid());
printf("Effective UID\t= %d\n", geteuid());
printf("Real GID\t= %d\n", getgid());
printf("Effective GID\t= %d\n", getegid());
return EXIT_SUCCESS;
}
$ gcc -Wall print_id.c -o print_id
$ chmod ug+s print_id
$ su test -c ./print_id
Password:
Real UID = 1008
Effective UID = 1007
Real GID = 1008
Effective GID = 1007
$
Setuid on directories
Setuid and setgid flags on a directory have an entirely different meaning. Directories with the setuid/setgid permission will force all files and sub-directories created in them to be owned by the directory owner/group and not the user/group of the user creating the file.
See also
- Sudo
- Unix security
- chmod
- User identifier (Unix)
- Group identifier (Unix)
- File system permissions
- Privilege revocation
- Privilege separation
External links
- Hao Chen, David Wagner, Drew Dean: Setuid Demystified (pdf)
- Wayne Pollock: Unix File and Directory Permissions and Modes
"Setuid"