$ cat ./pokus #!/bin/bash echo "Ty si $USER" wc -l /etc/shadow $ chmod 755 ./pokus $ ./pokus Ty si dvh wc: /etc/shadow: Permission denied
Teraz ako root:
# ./pokus Ty si root 38 /etc/shadowNastavim suid
# chown root:root ./pokus # chmod 755 ./pokus # chmod +s ./pokus # ls -la ./pokus -rwsr-sr-x 1 root root 48 2008-02-24 19:11 ./pokus # ./pokus Ty si root 38 /etc/shadow
Teraz ako obyc user
$ ls -la pokus -rwsr-sr-x 1 root root 48 2008-02-24 19:11 pokus $ ./pokus Ty si dvh wc: /etc/shadow: Permission denied
Ked je tam suid, nemalo by to spustene pod obyc userom vypisat to ako keby som to spustil ako root?
#define REAL_PATH "/bla/bla/bla" int main(int ac, char **av) { execv(REAL_PATH, av); }