1

If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it?

The big question: what prevents using sudo instead of the setuid/setgid binaries?

"ping" would be enough for root, no? If a user wants it, give it sudo permission?

  • So you are suggesting to use a single setuid binary (sudo) instead of using multiple setuid binaries? What about passwd (tool for changing the users password) which is also setuid? – Steffen Ullrich Dec 23 '19 at 13:17
  • Do you realize that sudo is itself a setuid binary? – Joseph Sible-Reinstate Monica Dec 23 '19 at 13:47
2

Because your suggestion doesn't reduce the attack surface at all. In fact, it increases it. With programs like ping being setuid, it would take a vulnerability in ping itself to exploit it. If the file itself weren't setuid, and users instead had permission to use it via sudo, then either a vulnerability in ping or one in sudo would do. And even if the system has sudo anyway, most of the security bugs that have been found in it over the years have been ways for a user with some sort of permission to use sudo to instead gain full root. Bugs that a user with no sudo access at all can exploit are essentially unheard of.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.