|
343 | 343 | \item \label{SUID_BIT} The SUID and SGID bits are used for programs that need |
344 | 344 | bigger privileges than the user who executes them. One example is the |
345 | 345 | \texttt{passwd} program that needs to update files \texttt{/etc/passwd} and |
346 | | -\texttt{/etc/shadow}, where the ordinary user cannot modify the first and |
347 | | -cannot write into the the second. Another example is the \texttt{su} program, |
348 | | -which has to have the right to arbitrarily change user and group identity, |
349 | | -which is a privilege of programs running with UID~0. |
| 346 | +\texttt{/etc/shadow}, where the ordinary (i.e. non root) user process cannot |
| 347 | +modify the first and cannot write into the the second. Another example is the |
| 348 | +\texttt{su} program, which has to have the right to arbitrarily change user and |
| 349 | +group identity, which is a privilege of programs running with UID~0. |
350 | 350 | \item Programs using the SUID and SGID bits should be carefully programmed |
351 | 351 | to allow only the operations for which they were designed and prevent misuse |
352 | 352 | of their privileges for non-authorized actions (root shell execution). |
|
357 | 357 | (i.e. secure) SUID/SGID program, especially of higher complexity. |
358 | 358 | \item \emsl{These are the rules for ID change:} |
359 | 359 | \begin{itemize} |
360 | | -\item an ordinary user cannot change its RUID or saved UID (the \texttt{exec} is |
361 | | -an exception to that, see page \pageref{EXEC}) |
| 360 | +\item an ordinary user process cannot change its RUID or saved UID (the |
| 361 | +\texttt{exec} is an exception to that, see page \pageref{EXEC}) |
362 | 362 | \item the process can always change its EUID to that of the RUID or saved UID. |
363 | 363 | This guarantees that in a SUID program, it is possible to arbitrarily change the EUID |
364 | 364 | between the one that enabled the process to gain ownership rights and the |
|
370 | 370 | \end{itemize} |
371 | 371 |
|
372 | 372 | %%%%% |
373 | | - |
| 373 | + |
374 | 374 | ifdef([[[NOSPELLCHECK]]], [[[ |
375 | 375 | \pdfbookmark[1]{getuid, getgid, geteuid, getegid, getgroups}{getuid} |
376 | 376 | ]]]) |
|
0 commit comments