Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm reading this and I'm little confused. What exactly is this setuid based script root spoofing?

share|improve this question
up vote 1 down vote accepted

This is a theoretical attack that could allow a user to elevate their privileges to root.

Say we have a setuid-root like this:

echo Hello World!

When the script is executed, the OS reads the first line, the uses that program to run the script. The command it will execute is: /bin/bash

A twist on setuid scripts is that a user can create a link to the script, say and now the command would be /bin/bash This is starting to be a bit worrying because perhaps the user could call their link -c ls - and run a command as root that they're not supposed to.

However, bash and Linux have a number of other defences that make this impractical. For example, the command on Linux would be /bin/bash "./-c ls" which is not exploitable. It's possible that other shells and OS are vulnerable.

All of this only applies if you have a setuid-root shell script. This is not recommended anyway - for these reasons and more. In fact, on Linux you can't have setuid shell scripts at all.

If you're interested in this area in general, Nebula is worth a look.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.