[EN] Linux file permissions - SUID

File permissions are a basic concept in Linux systems to manage permissions to write, read and execute files.
In this article I would like to limit myself to a less common file right - the SUID-bit.

By setting the SetUserID bit a file is always executed with the rights of the file owner.

What is the file permission used for?

An example of a meaningful use of this file right is the program passwd, which changes passwords of users and groups. In order for a user to change his own password, the SUID right must be set. Thus, the program is executed as root.

Schema

The SUID bit is displayed as follows:
The SUID bit is indicated by a s or S at the position of the file permission to execute a file (x).

A small s means that an execution is also possible in addition to the SUID bit. However, this is not possible with a large S.

Why is the SUID bit "dangerous"?

The SUID bit should be used very carefully and only when really necessary. Because the privileged execution of a file creates a potential security risk. If a file is manipulated accordingly, rights can be extended ( privilege escalation).

Example

The program find with the original rights:

find offers the possibility to execute commands using -exec :

Now the SUID bit is set: chmod +s /usr/bin/find

Then we execute the same command as before:

So it is now possible to execute arbitrary code as root. If unauthorized access to a system has taken place, a "backdoor" can be set up with which it is possible to obtain administrative rights from any user.

Which files have set the SUID bit?

Files with SUID rights can be found, for example, using:

find / -user root -perm -4000 -print 2>/dev/null