GNU bug report logs - #22511
chown: add "--preserve-setuid" option

Previous Next

To reply to this bug, email your comments to 22511 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: William Di Luigi <williamdiluigi <at> gmail.com>
To: bug-coreutils <at> gnu.org
Subject: [request] Add "--preserve-setuid" to the chown command
Date: Mon, 1 Feb 2016 03:33:29 +0100

Hi,
if I understand it correctly, chown clears the setuid bit for security
reasons (since, when changing the owner or group for a file, you could
potentially be allowing *new people* to run that file as root).

While this is good for security, sometimes you want to be able to
preserve the setuid bit. For example, when packaging software
(https://bbs.archlinux.org/viewtopic.php?pid=1600551)

What do you think about adding a "--preserve-setuid" optional flag?

Regards,
William

Message #8 received at 22511 <at> debbugs.gnu.org (full text, mbox):

From: Erik Auerswald <auerswal <at> unix-ag.uni-kl.de>
To: William Di Luigi <williamdiluigi <at> gmail.com>
Cc: 22511 <at> debbugs.gnu.org
Subject: Re: bug#22511: [request] Add "--preserve-setuid" to the chown command
Date: Mon, 1 Feb 2016 09:20:30 +0100

Hi,

On Mon, Feb 01, 2016 at 03:33:29AM +0100, William Di Luigi wrote:
> if I understand it correctly, chown clears the setuid bit for security
> reasons (since, when changing the owner or group for a file, you could
> potentially be allowing *new people* to run that file as root).
> 
> While this is good for security, sometimes you want to be able to
> preserve the setuid bit. For example, when packaging software
> (https://bbs.archlinux.org/viewtopic.php?pid=1600551)

How about using "install" to install files, setting owner and mode bits
in one go?

HTH,
Erik
-- 
Always use the right tool for the job.
                        -- Rob Pike

Message #11 received at 22511 <at> debbugs.gnu.org (full text, mbox):

From: William Di Luigi <williamdiluigi <at> gmail.com>
To: Erik Auerswald <auerswal <at> unix-ag.uni-kl.de>
Cc: 22511 <at> debbugs.gnu.org
Subject: Re: bug#22511: [request] Add "--preserve-setuid" to the chown command
Date: Mon, 1 Feb 2016 10:32:43 +0100

On Mon, Feb 1, 2016 at 9:20 AM, Erik Auerswald
<auerswal <at> unix-ag.uni-kl.de> wrote:
> How about using "install" to install files, setting owner and mode bits
> in one go?

Mmm I guess it's just that, since I'm packaging an already existing
software, I'd like to patch it as little as possible. In fact, the
Makefile for this software already sets the setuid bit on the file
that needs it. I only need to change the group of that file (and thus
I need to run the chown command on it). However, since chown removes
the setuid bit, I have to "add it back" in the packaging script.

It doesn't make much of a difference, since I can just do chown and
chmod (as I currently do). However, if the proposed flag is
implemented, I can avoid "adding back" the setuid bit and thus I can
simplify the packaging script (well, not by much, I would remove just
2 lines: the chmod line and the bash comment explaining why the chmod
is there).

--
William

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.