Dear Lina

Stick to the Script

Dear Lina:
I have a script that needs to run under a different user id. While the setuid bit is set for the script file, it doesn't seem to work. I've been trying fruitlessly to get this to work. When I asked a co-worker how to fix it, he chuckled and told me, "Just don't do that." How can I get this working?
 
Setuid Scripter from Sierra Vista

Dear Scripter:
Unfortunately, darling, your rude co-worker was partly right. There are some pretty good reasons why Linux and many UNIX kernels don't allow suid scripts. suid shell scripts create large security holes if written improperly. For instance, if any temporary files are created or read, a malicious user could exploit a race condition, change the contents of the file, and take control of the script. Another potential danger can arise if the shell programmer becomes careless with command arguments. In this case, dear, the script could accidently spawn an interactive shell. Eek!

The remedy to this problem is to add a dash to your interpretor string:
#!/bin/sh -
If you absolutely must run your script suid, you can wrap it up like sushi in an executable, which the kernel will allow. Here is a standard C wrapper template:

#include <unistd.h> 
int main (void) 
{ 
  execl ("/bin/bash", "bash", "/usr/bin/myscript.sh", NULL); 
  return 1;
}

The first argument to execl is the path to your executable, and the second argument is the command you wish to run. These arguments are followed by 0 or more command line options. In this case, myscript.sh needs to be interpreted by bash, like this: /bin/bash /usr/bin/myscript.sh. For more detail, love, see the exec(3) man page.

Also, hon, make sure that the last argument to execl is NULL. If you forget this, the program won't stop searching for more command options and will crash. Oopsie!

After you compile the C code, you can set whatever permissions you need on the resulting binary and the kernel shouldn't balk at running it. Also check with your specific shell language. Some, like perl, include a workaround for this type of problem.

Just be careful out there, darling. If at all possible, try to create your script so that you don't need suid permissions in the first place!

Wrapping up,
Lina

Dear Lina:
I'm having trouble with my Debian system (kernel 2.2.12). Logged in as user 'mike,' I can launch Netscape with no problem. Then I created user 'jodie' and copied my .bashrc, .xinitrc, .Xdefaults, etc. files over to give her a similar environment. Now, if I log in as 'jodie' and try to launch Netscape, all I get is a "Bus Error" message and Netscape doesn't start. I checked permissions/ownerships and everything else I could think of, but nothing seems to matter. I can't figure out what the problem might be. I haven't had problems launching anything else under her account. Any ideas?
 
Bussed out in Birmingham

Dear Bussed:
Netscape is notorious for causing bus errors, hon. These types of errors are usually caused by a program performing illegal memory operations. When Linux distributions first started the transition from libc5 to glibc2, this sort of problem began to appear frequently.

The new C libraries implement memory allocation procedures in a slightly different way. Since Netscape was dynamically linked, it used whichever installed libraries were most current, hence the increase in bus errors. Eep!

The latest version of Netscape shouldn't have these problems. If you are using an older version of Netscape, it is worthwhile to upgrade. I also recommend trying the new Netscape 6 Preview Release or a daily Mozilla build. Although these browsers are still under construction, they are rapidly approaching stability. They're also new enough to have been developed with the newer libraries.

On the other hand, hon, try downgrading to a lower version. Netscape 3.0 is known to play just fine with earlier versions of libc.

Because you seem to be having trouble with only one of your user accounts, there are a couple other things you can try to soothe your current browser. If you have installed any plug-ins, make sure that your ~/.netscape/plugin-list is the same in both user accounts. You may have forgotten to update this when you added the second user. To be safe, try synching the entire .netscapei directory for both users.

Finally, Netscape has serious implementation problems with Java and Javascript. Turning off either or both of these may eliminate your problems.

Launched,
Lina

Lina is a system administrator for Linuxcare. She has administered Unix systems since go-go boots were in style, and received her Cisco certification in 1997. She prefers Debian, secure shell, cappuccinos, and sushi. Her Dear Lina column appears every Monday at www.linuxcare.com. Send Lina your technical questions and fan mail to lina@linuxcare.com.