How can I let users run a script with root permissions?

Question

Given the dangers of SUID shell scripts , is there a more secure way of giving passwordless access to scripts (bash, PHP) with root permissions in Linux?

(Ubuntu 8.10)

Answer 1

Answer 2

You could consider sudo .

Although not 'passwordless', it doesn't require the user to be given the root password. It can also provide an audit trail of use of the script.

edit: as per comment from Chris, there is an option not to require a password at all for certain commands, see here for details. It can also be set up not to prompt excessively for the password, ie one entry of the password can be good for multiple commands over a period of use.

By the way, sudo is built in to Ubuntu and nicely integrated with Gnome. When ubuntu prompts you for your password to do privileged operations, that's sudo under the hood.

Answer 3

如果您使用sudo路线，请确保查看sudoers手册页的“ 防止外壳泄漏 ”部分。

Answer 4

I would recommend sudo . Be sure to tighten your sudoers file appropriately; and yes, you can allow some commands to be executed with no password being requested.

Answer 5

Configuring sudo to let normal users run shell scripts with elevated privileges isn't any better from a security standpoint than making the script suid root. All the pitfalls still exist. Instead you should write a proper program that does extensive security checks. Some points to consider:

Don't write it in C, you'll shoot yourself in both feet.

Check all inputs.

Drop privileges as soon as possible.

Keep it short.

Answer 6

由于已经提到了sudo ，因此您可能需要根据自己的需要考虑各种沙盒环境，例如监狱或类似环境。

Answer 7

To improve security consider whether it is possible to do the operation as a special user or group, which has exactly the access rights needed for it. Then you can make the script setuid/setgid for that user or group.

Answer 8

对于真正重量级的解决方案，请考虑使用MAC（强制性访问控制）系统，例如SELinux，AppArmor，TrustedBSD等。

Answer 9

If the use case is a machine running under VirtualBox and security isn't really an issue, you just want a light barrier to prevent yourself shooting yourself in the foot, what then? (Then the security arguments don't really make sense, since it doesn't matter if the machine gets compromised by an outsider who can't see it anyway due to the way VirtualBox insulates it via NAT.)