How is it possible that to be able to execute a binary file with 755 permission, one has to be in sudo'ers list ? I am trying to let a program run by a non-sudo user. It does not happen, but if I execute via sudo or as root, it works as it should.

File permission is 755 root root.
The whole program directory is in /opt.

Some details:
Ubuntu 12.04 Server, 64bit
the software is basically an old 32bit version of Firefox 1.9.something, modified to some extent to connect to a Tomcat server.

a user not listed in sudo'ers list can start the program.
only my sudo user cannot, i.e. by running simply ./program,
sudo ./programm runs just fine.

  • oops ... I think I have some other type of problem. – user218025 Nov 21 '13 at 20:20

The most probable reason is that the program, once running as a normal user, is trying to read some file or doing some operation which is reserved to privileged users (basically root).

For example, if your program is trying to using (binding) to one of the lower internet ports (less than 1024) it needs root privileges to do that (1). Or it try to read a file or use a library which is marked for root only.

The hammer(2) solution is to mark the program set-uid root (SUID-root). This is quite dangerous, it should be avoided by coding the program so it does not need it, and it is practically impossible to distribute --- I would never accept set-uid programs form unofficial sources in my computer, and even then I don't like them either. I am posting the answer because I think it's good to know that they exists.

So making sure that all the services/files that the program uses are accessible to it is the correct solution, otherwise probably the program must be run as root with all the consequences.

Big fat warning: this is dangerous, and SUID-root programs can do whatever they want to the system. If they have bugs, the user can easily take control of the whole system or destroy it.

If you make a program set-uid root, anyone can run it, and it will run as root. This will work only for binary executable; set-uid bit do not work for scripts (shell, python or whatever).

If you really want to run a script as root, you need a wrapper, as the one in this answer on stackoverflow. But before doing that, read all the question an be sure to understand the (not so) fine points about security. If you really want that script running as root for every user, I would opt for editing sudoers so that they can run it with sudo without having any password asked. This answer on stackoverflow lists a lot of ideas.

Example of set-uid usage: I make a copy of cat (output the content of a file to terminal), change it to be owned by root, and try to read a file owned by root and that only root can read:

(0)asus-romano:~/tmp/suidtest% cp /bin/cat .              
(0)asus-romano:~/tmp/suidtest% ls -l ./cat
-rwxr-xr-x 1 romano romano 46884 Nov 21 09:49 ./cat
(0)asus-romano:~/tmp/suidtest% sudo chown root.root ./cat
(0)asus-romano:~/tmp/suidtest% ls -l
total 48
-rwxr-xr-x 1 root root 46884 Nov 21 09:49 cat
(1)asus-romano:~/tmp/suidtest% ./cat /etc/shadow- > /dev/null
./cat: /etc/shadow-: Permission denied

Now, I change the program to be suid-root (notice the s in the permission flags):

(0)asus-romano:~/tmp/suidtest% sudo chmod u+s ./cat
(0)asus-romano:~/tmp/suidtest% ls -l ./cat
-rwsr-xr-x 1 root root 46884 Nov 21 09:49 ./cat
(0)asus-romano:~/tmp/suidtest% ./cat /etc/shadow- > /dev/null

No error...

Again, do not do it unless you trust completely the program and the users.

(1) well, there are fine-grained privileges in Linux called capabilities, but are seldom used and quite complex...

(2) when you have a hammer, all things starts looking like nails...

  • It doesn't work in this case. Program's behavior is exactly same with or without s bit, as long as the user is a sudo'er. I have checked it. – user218025 Nov 21 '13 at 21:00
  • Is the program a binary or a script? If it's a script (of whatever language) setuid will not work. If not, I really do not know what to think. Try to run the program with strace and see where it fails. – Rmano Nov 21 '13 at 21:08
  • yes, it is a script. When it runs, it calls firefox. Firefox is itself a script. It calls run-mozilla.sh, which is again a script, but here the scipting game is over.<br> rum-mozilla calls "firefox-bin -app application.ini". strace is something I did not know. I'll try to use it as well. Thanks. – user218025 Nov 22 '13 at 4:54
  • I added some comment about running script set-uid, and interesting links. – Rmano Nov 22 '13 at 15:42

I would try moving the file to a group other than root... If you read this: https://help.ubuntu.com/community/FilePermissions

and you -ll and see XXXX root root

Means that your file/program belongs to "root" and is 755-able to members of the "root" group. Therefore, either

1) add your other non-root users to the root group, or 2) create a brand-new group and assign that group to the files/programs you are running.

Here for creating groups and stuff: https://wiki.archlinux.org/index.php/Users_and_Groups

I hope that helps!

  • I can't see a -ll in the File Permissions guide, do you mean ls -l? Hint: check the editing help to improve the formatting of your posts. – brasofilo Nov 21 '13 at 17:04
  • probably he wanted to write "and you'll see ...." – user218025 Nov 21 '13 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.