如何设置 SUID 位以授予 root 权限？

Question

my question is super beginner, In my C program. I want to set the SUID bit (root permission) before creating a raw socket and then I want to switch back to normal permission after I have created it. Before I used to run my code using command sudo./client which gave the whole executable root permissions. I want to give root permissions only to the point where I create the socket, so that I can run my code using simply ./client .

EDIT: Realized that I have to set the SUID bit and not the sticky bit for how I want the executable to behave.

Answer 1

The original version of the question was confusing the sticky bit ( S_ISVTX ) with the SUID or set UID bit ( S_ISUID ). It has since been updated.

To make the program run with root privileges while creating the raw socket, you would create your executable by compiling it as normal, and then have root take ownership of the executable ( chown root./client ) and set the permissions ( chmod 4555./client ). Note that the permissions are carefully chosen and do not allow either group or others to write to the program (modify the executable). The fact that the owner, root , has no write permission does not stop root from writing to the file — though root won't want to change it often. Normally, root would copy the program to some directory where ordinary users cannot make changes. That might conceivably be /usr/local/bin , or it might be somewhere else.

^{Note that the permissions are set on the executable, not the source code (see the original version of the question), and must be set before the program is run.}

Inside the program, after creating the raw socket, you could remove the root privileges, thereby avoiding many security issues in the code after that, by executing: setuid(getuid()) . This changes the effective UID back to the same as the real UID. Note that the POSIX specification for setuid() says:

If the process has appropriate privileges, setuid() shall set the real user ID, effective user ID, and the saved set-user-ID of the calling process to uid .

A program that is SUID to root has 'appropriate privileges'; there is no going back. Using seteuid() (as originally suggested) would not be as safe as using setuid() .