What's to stop somebody from creating a setuid-root binary on a flash drive, then putting it into another person's computer and getting root access?

Question

What's to stop somebody from creating a setuid-root binary on a flash drive, then putting it into another person's computer and getting root access? I assume there's some kind of protection against that, but I don't have a spare drive to test with.

EDIT: Formerly said "script"; changed to binary. See my comment.

Are you just interested in scripts, as your question implies, or do you want information on similar types of apparent attacks? If just scripts, why? If not, could you please clarify your question? — Daniel H, Aug 14 '11 at 06:38
@DanielH This is an old question that has already been answered, but when I asked this I wasn't aware that setuid didn't work on scripts. I just said scripts because I figured that would be the most convenient way to escalate privilege in this manner, if it worked. But my question applies just as much to binaries as well. I'll edit it. — flarn2006, Jul 31 '19 at 16:59

score 6 · Accepted Answer · answered Aug 14 '11 at 04:15

6

If a volume is mounted nosuid then the setuid bit is ignored on executables. At least newer versions of Fedora mount external media with this option.

Also, setuid does nothing for scripts unless the interpreter is prepared to run a separate copy of the interpreter as the user in question. Not many are.

answered Aug 14 '11 at 04:15

Ignacio Vazquez-Abrams

111,361
10
201
247

3

The script/suid issue isn't that big - you can always right a simple C program that just executes the shell. – Daniel H Aug 14 '11 at 06:18
@Daniel: Sure, but that's out of scope for this question. – Ignacio Vazquez-Abrams Aug 14 '11 at 06:19
… and the `nosuid` option would stop that binary from employing set-UID, too. – JdeBP Aug 15 '11 at 00:50
2

Interpreters won't get a choice in the matter of whether a separate process is run or not if the script is executable and employs `#!`, by the way. – JdeBP Aug 15 '11 at 00:55

What's to stop somebody from creating a setuid-root binary on a flash drive, then putting it into another person's computer and getting root access?

1 Answers1