ABCD wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hinko Kocevar wrote: >> Hi, >> >> I'm trying to touch a file in /sbin during boot time >> and would like to do that with a normal user by running >> SUIDed shell script. >> I have following script: >> hin...@alala /tmp $ cat test.sh >> #!/bin/sh >> >> touch /sbin/foo.bar >> exit $? >> >> hin...@alala /tmp $ sudo chmod +x test.sh >> hin...@alala /tmp $ sudo chown root:root test.sh >> hin...@alala /tmp $ sudo chmod +s test.sh >> hin...@alala /tmp $ ls -l test.sh >> -rwsr-sr-x 1 root root 32 Mar 2 09:27 test.sh >> hin...@alala /tmp $ sh -x test.sh >> + touch /sbin/foo.bar >> touch: cannot touch `/sbin/foo.bar': Permission denied >> >> Can somebody help me with that? >> >> Thank you! >> >> Best regards, >> Hinko > > Linux does not support s[ug]id scripts, however, you can emulate the
Hmm, I was not aware of that.. > effect of it using sudo - in your shell script, do the following: > > #!/bin/sh > [ $(id -u) -ne 0 ] && exec sudo "$0" "$@" > > # put the rest of the script here > > and add a line to /etc/sudoers that reads: > > ALL ALL=NOPASSWD: /path/to/script > > This will allow any user (the first "ALL") from any host (the second > "ALL") to run /path/to/script as root:root without any authentication, > by simply calling /path/to/script (or just "script", if it happens to be > in the $PATH). > > NB - I havn't actually tried this recently, so I might be wrong on some > of the specifics, but the general idea should hold. > > Also, if you want to restrict *who* can run the script, you can change > the first "ALL" to something else, see sudoers(5) for details - also you > can restrict *where* it can be run by changing the second "ALL". > > If you want to make the user enter *their own* password, remove the > "NOPASSWD:". If you want to make the user enter *root's* password, read > the man page - I don't remember the option, but I know there is one. > Thanks for detailed info! Best regards, Hinko -- Hinko Kočevar, OSS developer ČETRTA POT, d.o.o. Planina 3, 4000 Kranj, SI EU tel ++386 (0) 4 280 66 03 e-mail hinko.koce...@cetrtapot.si http www.cetrtapot.si
