16

I am running this small python script on both linux and Solaris as a not privileged user :

#!/usr/bin/python
import os
print 'uid,euid =',os.getuid(),os.geteuid()

Before running, the setuid bit is set on the script (not on python interpreter) :

chown root:myusergrp getuid.py
chmod 4750 getuid.py

On Solaris, the effective uid is set because of the setuid bit :

uid,euid = 10002 0

But not on Linux :

uid,euid = 10002 10002

Note the python version is 2.6 for both Solaris and Linux

Is it possibe to have Python Linux working as Python Solaris ?

4 Answers 4

29

Most Unix distributions normally don't allow you to use setuid on a file that uses a #! interpreter. Solaris happens to be one that allows it due to its use of a more secure implementation than most other distributions.

See this FAQ entry for more background about why the mechanism is so dangerous: How can I get setuid shell scripts to work?

See this link for more discussion and how to compile a setuid executable that will run your script: setuid on shell scripts

The pertinent part:

int main()
{
   setuid( 0 );
   system( "/path/to/script.sh" );

   return 0;
}
3
  • Solaris is based on SVR4, which as your FAQ link notes, uses more secure ways than older Unixes to handle setuid script startup.
    – alanc
    Nov 30, 2011 at 3:55
  • What if your python script needs to be started as non-root user, and then suid during execution at some point? Mar 21, 2015 at 0:54
  • You need to start as root and then temporarily drop privileges to the user before resuming root. See this question for more info: stackoverflow.com/questions/8499296/… Mar 21, 2015 at 2:08
2

I just put two and two together today and came up with an alternative solution: cython --embed.

Follow the examples at the link above and you'll get binary executables from your Python that you'll be able to chown and chmod u+s, completing the circle without a wrapper program.

Of course, beware the risks (of this or any other setuid use)—bugs in your script can result in elevated privileges on the system.

2

Based on David K. Hess answer, but with arguments:

#include <unistd.h>

int main(int argc, char **argv)
{
    setuid(0);
    execv("/path/to/script.sh", argv);

    return 0;
}
-2

You could potentially use sudo to achieve what you want. It runs stuff as different users:

 sudo -u otheruser command

Permissions are set by root using visudo. The setuid/setguid stuff doesn't appear to apply to scripts or the shell in linux, only compiled code.

1
  • Setuid bit used exactly to avoid privilege escalation
    – P. Dmitry
    Oct 7, 2019 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.