Very Computer

by **Eros Albertazz** » Wed, 27 Mar 2002 20:56:50

I would like to create a script (or a program, with exec family
function? how?) to allow users to cat a file owned by root
(They are the input of jobs to be run by the OpenPBS batch system,...and
this system store them in root directory, in read for root only)

I am aware that Linux shells drop the setuid to root ( and indeed I
obtain, with such a script, a "permission denied")

What can I do? Any hints or template?
Regards.
--
Eros Albertazzi
CNR-IMM, Via P.Gobetti 101, 40129 Bologna, Italy
Tel: (+39)-051-639 9179
Fax: (+39)-051-639 9216

by **those who know me have no need of my nam** » Thu, 28 Mar 2002 03:45:53

Quote:>I would like to create a script (or a program, with exec family
>function? how?) to allow users to cat a file owned by root

this (a set-uid root script) is almost always a mistake, since most
interpreters can be influenced by the environment and that can be used to
cause them to misinterpret the script, often providing local elevation to
root.

Quote:>What can I do? Any hints or template?

sudo can solve the problem, e.g.,

script (which is not set-uid):

#!/bin/sh
sudo cat /root/file

sudoers entry:

ALL=(root) NOPASSWD: /bin/cat /root/file

--
bringing you boring signatures for 17 years