Setting permissions for shell scripts

UNIX for Advanced & Expert Users
1

Hi,
I have written a shell script which calls a java program which reads properties from a configuration file and writes to a log file for each session.However the customer wants that the user should not be able to open/edit the configuration file or the log files meaning they should not have any rights on the files.
I tried setting the user id of the shell script giving the user permission to run the script as root so that the owner of the script,configuration file and log file directory is root,and the user will not normally be able to access the said files.However it seems that setuid is not working as it still shows that permission is denied to access the files.However when I set uid on the java executable I was able to run the script without any problems.However that opens another security issue as the java executable can be used by anyone to run any java code compromising the security further.I am working on a Sun Solaris box(namely OSS-RC).
I am in a fix.It would be great if you were able to help me out in this.

2

Can you post "ls -l" output for the shell script, java file, and the config files being used?

Here's my thought:

  1. Create a separate user account and group ID.
  2. Change ownership of the shell script, java file, and the configs to this UID and GID.
  3. Provide read and execute permission on the shell script and java file. Read+write (if modification is required) for the config files. Make sure "others" do not have any permission on the files.
  4. Create another group and add the users who should run the shell script in that.
  5. Create ACL and assign this group execute permission on the shell script.

Here's the expected result:

The user tries to execute the shell script. As he belongs to the second group and has execute permission on the shell script through ACL, he would be able to do so. Now, as the SGID bit set, the script will run with the owner GID which provides execute permission to the java code and read+write permission to the config files even though the user's UID does not have any explicit permission on them. You have to make sure that the shell script does not contain anything which would give shell escape to the user.

hope this helps! :slight_smile:

3

Solaris does not support setuid shell scripts.

4

Are you sure of this? I tested the steps I listed in my previous post and it worked fairly smoothly. I use Solaris 10. I have tried using both SUID and SGID bit set on ksh script. It works!

But, yes, Linux (RHEL 6.0) is ignoring the SUID bit on shell script and my steps do not work there.

5

You cannot elevate your privilege by changing the permissions on a Shell Script file. This applies to all modern unix and Linux Shells.