10

I understand that this is a bit fundamental and perhaps a silly question, but I haven't been able to find an answer.

I understand that every file has the "Executable" bit.

I assumed that programs that require root, that are owned by root user and root group will not have the Executable bit for Other and that would prevent non-root users executing those. But in the /bin and /sbin directories I see that all the files have permissions like -rwxr-xr-x

So what really determines if a user needs to have root permission to execute something?

Dean
  • 813
  • 1
  • 10
  • 25
  • 1
    By default, you or any user can execute any program from /bin or /sbin directories. The problem is that some of those programs are running different depending on which user runs them. – Radu Rădeanu Sep 25 '14 at 09:06

1 Answers1

13

Sometime, it's in the code. For example, midway of hwclock.c, you'll find: 

if (getuid() == 0)
            permitted = TRUE;
else {
            /* program is designed to run setuid (in some situations) */
            if (set || systohc || adjust) {
                    warnx(_("Sorry, only the superuser can change "
                            "the Hardware Clock."));
[...]

which will change the behavior of the program if you're root or not.

In most other cases, it's implicit; delegated to the kernel. For example, if the program calls the system call that let you reboot the system, it will work only if you are root. If you are not root, you will have a "permission denied" error that the application (if well written) simply reports to you. Or you are trying to delete a file; if you have the right permission on the file to do it, it will succeed; if not, it depends if you are root or not --- when rm calls unlink() the kernel will check permissions.

So no, in principle you can't say just looking at the permission of the executable if the program requires root privileges or not. A lot of programs will require them only for some operation, so it will be really difficult to do something like that. The case of hwclock is one (anyone can read the clock but only root can set it), but there are hundreds of them (kill, rm, cat... )

Then there is the related and interesting world of setuid programs...

Rmano
  • 31,947
  • So basically the kernel is "in charge of it"? If the program makes a system call, the kernel determines if the user running the program has to be root and enforces it? – Dean Sep 25 '14 at 08:24
  • 2
    Basically, yes. The program can do additional tests, but the permission check is at kernel level. Setuid-root programs are the exception; they run as root always so they need to check for permission themselves (and are a nice font of security flaws...) – Rmano Sep 25 '14 at 08:27