Using setuid Properly

Question

I've been scared too much by the warning about setuid. However I cannot find a way around using it.

I want to be able to run: arp -s 198.51.100.1 00:53:00:12:34:56 as the user steven but arp -s requires root.

Would this be the correct way to do it?

sudo nano example.sh
sudo chmod u+s example.sh
sudo chmod og-w example.sh
sudo chmod o+x example.sh
./example.sh

score 4 · Accepted Answer · edited Apr 13 '17 at 12:36

4

Short story: don't use setuid shell scripts (or any setuid/setgid script).

Solution: invoke the command using sudo.

sudo arp -s 198.51.100.1 00:53:00:12:34:56

To allow the user steven to run this command without entering a password, run visudo and add the following line:

steven ALL = (root) NOPASSWD: arp -s 198.51.100.1 00\:53\:00\:12\:34\:56

If you have other sudo entries for steven, the NOPASSWD: one(s) need to come last.

edited Apr 13 '17 at 12:36

Community

answered Apr 19 '14 at 00:57

Could I used `nano` instead? – Steven Apr 19 '14 at 10:41
1

@Steven Always use `visudo` to edit the sudoers file. It verifies the syntax. Despite the name, it doesn't necessarily invoke `vi`; set the environment variable `VISUAL` to your favorite editor, e.g. `export VISUAL=nano`. – Gilles 'SO- stop being evil' Apr 19 '14 at 10:58
I kept getting syntax errors. `steven ALL = (root) NOPASSWD: /usr/sbin/arp` works however – Steven Apr 19 '14 at 10:59
@Steven Ah, my bad, `:` needs escaping in the command. Edited. – Gilles 'SO- stop being evil' Apr 19 '14 at 11:06

1 Answers1