Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am reading Tanenbaum's Modern Operating Systems 3e. He says "Suppose that the program being attacked [with malicious code] is SETUID root in UNIX (or has Administrator power in Windows). The [malicious code inserted with a buffer overflow attack] can now make a couple of system calls to convert the attacker's shell file on the disk into SETUID root, so that when it is executed it has superuser power."

What does it mean to be SETUID root? Does he mean that the program has root permissions? Why does he say that the program is setuid root?

This somewhat of a language question, but to a security noob with only basic linux/unix that passage in the book is hard to understand. What's he talking about?

share|improve this question
    
"The setuid and setgid bits are normally set with the command chmod by setting the high-order octal digit to 4 (for setuid) or 2 (for setgid). "chmod 6711" will set the setuid and setgid bits (6), make the file read/write/executable for the owner (7), and executable by the group (first 1) and others (second 1). All chmod flags are octal." -wikipedia –  adric May 2 '12 at 20:45
add comment

1 Answer

up vote 6 down vote accepted

SETUID means that the executable can run under different permissions than the user who has executed it.

Certain applications are set like this so the users can run with low permissions but a specific application they need to run with higher permissions can be.

SETUID 0 or root means that when the program is run it is as if root ran it - which leaves you open to all the usual security risks of running something at high permission levels - it could potentially do anything to your system - so generally the number of applications that require SETUID should be minimised on a Unix box. Most security audits of Unix machines include looking for SETUID and SETGID files that are world writeable as they present a high risk.

share|improve this answer
    
So it might be better to say the program "has" setuid root? (Meaning that it has permissions to run as root). –  akh2103 May 2 '12 at 15:01
1  
It's just terminology, I think. I have only ever heard "application x is SETUID root" so I think that is the accepted usage. –  Rory Alsop May 2 '12 at 15:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.