Established method to enable suid scripts?
ait at p2ee.org
Wed May 11 16:31:44 UTC 2011
On Wed, May 11, 2011 at 10:14 AM, Jerry McAllister <jerrymc at msu.edu> wrote:
> On Tue, May 10, 2011 at 05:54:04PM -0700, Chris Telting wrote:
>> I've googled for over an hour.
As other have said suiding on scripts is not allowed in modern
versions of Unix. What I do for example, is create small C programs
suid them and use those special suid execs to do special stuff. For
example, if I need to erase some files created by the mysql daemon
process I will create a C exec called suidrm and have it suid to the
mysql owner so I can remove the temp files from an Apache CGI for
example. Any suid exec should be carefully evaluated and meant for one
specific thing, and avoid suiding to root if at all possible. If you
must you can copy the exec with a different name and suid it for a
specific purpose with a specific user, preferably not root.
Anyway, with the simple C program wrapper approach I have solved many
things like what you're trying to do.
More information about the freebsd-questions