{"id":22434,"date":"2013-05-13T11:56:48","date_gmt":"2013-05-13T06:26:48","guid":{"rendered":"http:\/\/vskills.in\/certification\/tutorial\/?p=22434"},"modified":"2024-04-12T14:16:55","modified_gmt":"2024-04-12T08:46:55","slug":"setuid-ps-df-ulimit-and-chroot","status":"publish","type":"page","link":"https:\/\/www.vskills.in\/certification\/tutorial\/setuid-ps-df-ulimit-and-chroot\/","title":{"rendered":"SetUID, ps, df, ulimit and chroot"},"content":{"rendered":"

Certify and Increase Opportunity.<\/span>
\nBe <\/span>
\nGovt. Certified Linux Administrator
\n<\/span><\/a><\/p>\n

Few common utilities helps in managing security in Linux.<\/p>\n

SetUID<\/strong><\/p>\n

Three special types of permissions are available for executable files and public directories. When these permissions are set, any user who runs that executable file assumes the user ID of the owner (or group) of the executable file.<\/p>\n

You must be extremely careful when you set special permissions, because special permissions constitute a security risk. For example, a user can gain superuser privileges by executing a program that sets the user ID (UID) to root. Also, all users can set special permissions for files they own, which constitutes another security concern.<\/p>\n

setuid and setgid (short for “set user ID upon execution” and “set group ID upon execution”, respectively)[1] are Unix access rights flags that allow users to run an executable with the permissions of the executable’s owner or group respectively and to change behaviour in directories. They are often used to allow users on a computer system to run programs with temporarily elevated privileges in order to perform a specific task. While the assumed user id or group id privileges provided are not always elevated, at a minimum they are specific.<\/p>\n

setuid and setgid are needed for tasks that require higher privileges than those which common users have, such as changing their login password.<\/p>\n

When set-user identification (setuid) permission is set on an executable file, a process that runs this file is granted access based on the owner of the file (usually root), rather than the user who is running the executable file. This special permission allows a user to access files and directories that are normally only available to the owner. For example, the setuid permission on the passwd command makes it possible for a user to change passwords, assuming the permissions of the root ID:<\/p>\n

-r-sr-sr-x\u00a0\u00a0 3 root\u00a0\u00a0\u00a0\u00a0 sys\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 104580 Sep 16 12:02 \/usr\/bin\/passwd<\/p>\n

This special permission presents a security risk, because some determined users can find a way to maintain the permissions that are granted to them by the setuid process even after the process has finished executing.<\/p>\n

The use of setuid permissions with the reserved UIDs (0\u2013100) from a program might not set the effective UID correctly. Use a shell script instead or avoid using the reserved UIDs with setuid permissions.<\/p>\n

ps<\/strong><\/p>\n

ps displays information about a selection of the active processes. It will \u201ccapture\u201d the system condition at a single time. If you want to have a repetitive updates in a real time, we can use top command. PS support three type of usage syntax style.<\/p>\n