0

I want to create a simple script to restart the Mac. The command requires root privileges, so I decided to create an executable with the setuid bit set and the owner being root.

For testing the setuid behaviour, the C file:

#include<stdio.h>
#include<stdlib.h>

int main() {
    system("echo $UID");
    system("echo $EUID");
    system("sudo echo hello");
}

I have put the executable in /usr/local/bin directory. I read somewhere on the internet that Mac only allows setuid bit for the owner root when all the directories till / are owned by root. So, I moved my executable in this directory.

-rwsr-xr-x    1 root           wheel  33016 Apr  2 08:50 somethingsdfsdf

However, the output of the executable is,

$ ./somethingsdfsdf
501
501
Password:
hello

As you can see, it is not the root user id but mine. Does anybody know what am I missing?

dbush
  • 205,898
  • 23
  • 218
  • 273
scipsycho
  • 527
  • 2
  • 4
  • 13

1 Answers1

0

On macOS, the setuid bit on an executable has an effect only if the executable is in a directory that is owned by root (and not open for writing by others). All directories in the hierarchy must also be owned by root. Otherwise it is ignored for security reasons.

The best method for elevating privileges may depend on how you intend to use and execute this script. For instance, if it is to be a scheduled task, you could use a Launch Daemon.

benwiggy
  • 1,440
  • 17
  • 35