I have to perform a number of 'housekeeping' tasks that need root access (Linux, Debian). Generally one time only, but I do need to check that they have been performed.

I don't really want to run the whole program as root though. Is there a good pattern to do these tasks without having the whole program as root?

The tasks are fixed and have no inputs from outside the system (IE no user inputs are needed). Some known tasks include changing the hostname and formatting an SD card.

  • Is your goal to keep the root access script small enough that a paranoid user can inspect it? Do you trust the user to follow instructions and only run the second after the first (root) script has succeeded? – candied_orange Jul 7 '17 at 2:48
  • This section of the program runs without user control. The computer that this program runs on is our computer and we have full control over it. – tl8 Jul 7 '17 at 3:08
  • 1
    Does this help? Let a user run a script with root permissions – candied_orange Jul 7 '17 at 3:23
  • The program is a binary and I did try setuid but without much success. I might see if I can get that example to work though. – tl8 Jul 7 '17 at 3:58

The answer is privilege separation, as used in SSH and numerous other network daemons. The idea is that you fork a second process. One of the processes drops root privileges. There is a pipe between these processes. The privileged process waits for input from the pipe, performs the operation and returns the result using the pipe. (Note: in some operating systems, pipes may not be bidirectional, so socket pair could be a better, i.e. more portable, option.)

The privileged code needs to be implemented very carefully so you are certain there are no stack smashing vulnerabilities. Of course, the privileged code cannot accept requests to execute arbitrary commands, or else you lose the benefits of privilege separation. So, in other words: the privileged code needs to verify everything in the request to do a privileged task.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.