Some programs need narrowly controlled access that their callers do not ordinarily have. On an executable regular file, the set-user-ID bit can cause a new process to receive the file owner's user ID as its effective user ID. The program can then perform operations authorized for that identity while retaining information about the caller.
Permissions · Lesson 5
Setuid
Learn how the set-user-ID mode bit affects executable programs and why it requires careful security review.
Setuid is not a general instruction to “run as root.” Its effect depends on the executable's owner, the operating system, the filesystem and mount options, and the way the program manages its credentials.
Recognizing Setuid
On systems that use a setuid passwd executable, a long listing may resemble:
$ ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 68248 Jan 10 09:30 /usr/bin/passwd
The lowercase s in the owner's execute position means both setuid and owner execute are set. If setuid is present but owner execute is absent, ls -l displays an uppercase S in that position.
Do not assume every distribution has the same mode or authentication design. Inspect the actual system rather than relying on the example.
What does lowercase s in the owner's execute position indicate?
Understanding the Credential Change
When the kernel honors setuid during execution, the new process normally gets an effective user ID based on the executable's owner. For a root-owned program, that can provide root-authorized access, but only while the program runs and only through the operations its code performs.
This mechanism can allow a carefully written program to validate a request and make a restricted change to protected state. For example, a local password-changing utility may need controlled access to authentication data that ordinary users cannot edit directly. Modern implementations also rely on PAM, file locking, policy, and other safeguards; setuid alone does not explain the complete workflow.
When a setuid executable is honored, which identity is primarily taken from the file owner?
Setting and Removing the Bit
Set setuid symbolically with:
$ sudo chmod u+s myfile
In octal notation, setuid contributes 4 in a leading special-bits digit:
$ sudo chmod 4755 myfile
Here, the leading 4 sets setuid and 755 sets the ordinary owner, group, and other bits. Remove setuid without otherwise changing the mode with chmod u-s myfile.
Which leading octal value represents the setuid special bit?
Treating Setuid as Security-Sensitive
A flaw in a privileged setuid program can become a privilege-escalation path. Such programs must validate input, control the environment and file paths they trust, avoid unsafe subprocess behavior, minimize privileged code, and drop elevated credentials as soon as possible.
Linux normally does not honor setuid on interpreted scripts because doing so safely has race and interpreter-related problems. Filesystems mounted with nosuid also suppress setuid and setgid effects. Prefer narrower mechanisms such as service-mediated operations, carefully scoped sudo policy, or capabilities when they fit the requirement.
Never add setuid to an arbitrary shell, interpreter, or copied program as an experiment on a shared system. Audit existing setuid files and practice only in an isolated disposable environment.
What is the purpose of mounting a filesystem with nosuid?
Lesson complete
You finished Setuid
You can now recognize setuid and explain its credential and security implications.
Find
sorSin the owner's execute position.Relate setuid execution to the executable owner's effective user identity.
Set or remove the bit with symbolic or octal
chmodmodes.Treat every privileged executable as security-sensitive code.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account