Permissions – Purpose of setuid with No Executable Bit

permissionssetuid

I am trying to understand permissions in detail. I was reading about setuid and it's uses. However, this particular case confuses me.

I have made a small script and now I have set the suid bit for the script as below. 

chmod u+s ramesh

I see the permissions set as below. 

-rwsrw-r--  1 ramesh ramesh   29 Sep 30 10:09 ramesh

Now, I believe with setuid any user could execute the script. Now, I did the command

chmod u-x ramesh

It gives me the permission as,

-rwSrw-r--  1 ramesh ramesh   29 Sep 30 10:09 ramesh

Now, I understand the S denotes setuid with no executable bit. That is, no one can execute this file.

So my question is, what practical purposes do the setting of S bit have? I am trying to understand from an example perspective for setting this bit.

Best Answer

Now, I believe with setuid any user could execute the script.

Not quite. To make the script executable by every user, you just need to set a+rx permissions:

chmod a+rx script

setuid means that the script is always executed with the owner's permissions, that is, if you have the following binary:

martin@dogmeat ~ % touch dangerous
martin@dogmeat ~ % sudo chown root:root dangerous 
martin@dogmeat ~ % sudo chmod a+rx,u+s dangerous 
martin@dogmeat ~ % ll dangerous 
-rwsrwxr-x 1 root root 0 Sep 30 17:23 dangerous*

This binary will always run as root, regardless of the user that is executing it. Obviously this is dangerous and you have to be extremely careful with setuid, especially when you are writing setuid applications. Also, you shouldn't be using setuid on scripts at all because it's inherently unsafe on Linux.

Now, I understand the S denotes setuid with no executable bit. That is, no one can execute this file.

So my question is, what practical purposes do the setting of S bit have? I am trying to understand from an example perspective for setting this bit.

I don't think that there is a practical purpose, IMO it's just a possible combination of the permission bits.

Related Question