Re: [cobalt-users] Disabling SU

[shimi <shimi@xxxxxxxxxxxxxxxx>]

On Mon, 23 Apr 2001, Rodolfo J. Paiz wrote:

> At 4/23/01 05:24 AM -0700, you wrote:
> >[shimi@www /bin]$ ls -l su
> >-rwsr-xr-x   1 root      root       13208 Apr 13  1999 su
> >
> >so... as you can see, the "other" access is r-x, which means read+execute.
> >
> >what you basically want is that only wheeled users could run this program,
> >right?
> >
> >so I would do...
> >
> >cd /bin
> >chgrp wheel su
> >chmod 750 su
> >chmod +s su
> >
> >that would basically allow only to root and users in the wheel group to
> >run that program.
> 
> DANGER WILL ROBINSON! DANGER! One of the things that su does is to setuid 
> root; hence it must have the setuid bit for the user created as well. You 
> should do:
> 
> chmod 4750 /bin/su
> 
> instead of what you have above, to put the setuid bit back in place.
> 

That's what the chmod +s command does... at least on my machine... ?

- shimi.