5 ms·
It is a setuid binary because it does sudo. You cannot accomplish sudo without setuid. Note that sudo means gaining privilege in the current context, with all
by floatboth 5y ago
It is a setuid binary because it does sudo.
You cannot accomplish sudo without setuid. Note that sudo means gaining privilege in the current context, with all its environment (including inherited file descriptors, the process group, etc.), not doing a privileged action at a distance.
> also true for the /usr/libexec/polkit-agent-helper-1 helper it uses which is a setuid binary but doesn't really have to be
Try making it non-setuid and see what happens.
(It will fail to check your password because most mechanisms for doing so, like the usual pam_unix, are only accessible to root.)
- Klasiaster 5y ago> You cannot accomplish sudo without setuid. Right, process group and being child process gets lost when following this route. I think it's a compromise that is acceptable in many cases. > [polkit-agent-helper-1] will fail to check your password because most mechanisms for doing so, like the usual pam_unix, are only accessible to root.) That's what I mean, the helper itself could be unprivileged and hand the password over to a privileged daemon that does the check.
- shawnz 5y agoIf you make the interface between unprivileged client and privileged server too complicated, eventually it will be more complicated than the interface of executing a setuid binary and potentially more likely to have bugs
- Klasiaster 5y agoHere for the pkexec/sudo case done using systemd-run - the script is similar to sudo and doesn't need to be setuid: https://gist.github.com/pothos/73dd4f7694acc3b6bbed614438f6e2b1 https://gist.github.com/pothos/73dd4f7694acc3b6bbed614438f6e...