SetUID和SetGID的问题

[青山丶]

问题一：

root用户创建了一个文件print.sh，该文件的权限为-rwsr-xr-x，该文件的内容就一行：whoami

我切换到zhangsan这个用户去执行print.sh，为什么输出“zhangsan”而不是“root”呢？难道不是以root的身份运行文件里内容么？

（我个人的理解，执行print.sh期间都是以root身份执行的，包括运行文件里的whoami命令。不知道这样理解对不对？）



问题二：

root用户创建了一个目录test，该目录的权限为drwxrwsr-x，

我切换成zhangsan这个用户进入test目录，为什么在该目录下创建不了新文件？

zhangsan用户进入test目录后不是临时变成root组里的成员吗，那怎么还创建不了新文件呢？

[青山丶]

引用 1 楼 micropentium6 的回复:

For security reasons, most of Linux distributions only allow s-bit work on binaries (compiled code) and not on scripts (an exception are perl scripts). That can explain why your sh file doesn't work. s-bit doesn't grant users the permission to create the file on the file system.

谢谢~ 第一个问题大概明白点了，您的意思是print.sh不是二进制文件，只是一个脚本，所以文件里的内容并不是以文件所属者的身份执行的。 第二个问题还不太明白，当我以zhangsan的身份进入test目录后，zhangsan的有效组会不会临时变成test目录的所属组（当test目录拥有SGID权限时会有这种效果吗）？若可以的话，zhangsan应该具有test目录的w权限啊？

[小笨和漂向北方]

引用 2 楼 u010134240 的回复:

[quote=引用 1 楼 micropentium6 的回复:] For security reasons, most of Linux distributions only allow s-bit work on binaries (compiled code) and not on scripts (an exception are perl scripts). That can explain why your sh file doesn't work. s-bit doesn't grant users the permission to create the file on the file system.

谢谢~ 第一个问题大概明白点了，您的意思是print.sh不是二进制文件，只是一个脚本，所以文件里的内容并不是以文件所属者的身份执行的。 第二个问题还不太明白，当我以zhangsan的身份进入test目录后，zhangsan的有效组会不会临时变成test目录的所属组（当test目录拥有SGID权限时会有这种效果吗）？若可以的话，zhangsan应该具有test目录的w权限啊？ [/quote] Setgid has a different meaning if applied on a directory. If s-bit is set on a directory as ur case, any new files/sub folders created in the directory will inherit the group id from their parent which otherwise will be set as same as the primary group of the user who create them. See the link below http://www.gnu.org/software/coreutils/manual/html_node/Directory-Setuid-and-Setgid.html

[青山丶]

引用 3 楼 micropentium6 的回复:

[quote=引用 2 楼 u010134240 的回复:] [quote=引用 1 楼 micropentium6 的回复:] For security reasons, most of Linux distributions only allow s-bit work on binaries (compiled code) and not on scripts (an exception are perl scripts). That can explain why your sh file doesn't work. s-bit doesn't grant users the permission to create the file on the file system.

谢谢~ 第一个问题大概明白点了，您的意思是print.sh不是二进制文件，只是一个脚本，所以文件里的内容并不是以文件所属者的身份执行的。 第二个问题还不太明白，当我以zhangsan的身份进入test目录后，zhangsan的有效组会不会临时变成test目录的所属组（当test目录拥有SGID权限时会有这种效果吗）？若可以的话，zhangsan应该具有test目录的w权限啊？ [/quote] Setgid has a different meaning if applied on a directory. If s-bit is set on a directory as ur case, any new files/sub folders created in the directory will inherit the group id from their parent which otherwise will be set as same as the primary group of the user who create them. See the link below http://www.gnu.org/software/coreutils/manual/html_node/Directory-Setuid-and-Setgid.html[/quote] 您的意思是zhangsan进入test目录后主组没变呗~ 是以“其他人”的身份在test目录下创建文件或目录，创建的文件或目录具有父目录的组id。我理解的对不对？

[小笨和漂向北方]

For security reasons, most of Linux distributions only allow s-bit work on binaries (compiled code) and not on scripts (an exception are perl scripts). That can explain why your sh file doesn't work. s-bit doesn't grant users the permission to create the file on the file system.

[小笨和漂向北方]

引用 4 楼 u010134240 的回复:

您的意思是zhangsan进入test目录后主组没变呗~ 是以“其他人”的身份在test目录下创建文件或目录，创建的文件或目录具有父目录的组id。我理解的对不对？

see, you will have to understand s-bit on the directory has nothing to do with s-bit on executable files. user zhangsan can create file in that directory (drwxrwsr-x) because he/she is either the owner of the directory or in the group assigned on the directory. Switching between real user/group to effective user/group only applies on executable binary files... Also, according to the GNU link I provided, the s-bit role on directory is allowed to be ignored by certain OS. So, it's not always true...