• 👉 Overview
• 👀 What ?
• 🧐 Why ?
• ⛏️ How ?
• ⏳ When ?
• ⚙️ Technical Explanations
• Overview
• Key Concepts
• Practical Example: The passwd Command
• Scenario
• Command Line Example
• Security Implications
• Conclusion
• 🖇️ References

👉 Overview

👀 What ?

EUID (Effective User ID), RUID (Real User ID), and SUID (Set User ID) are integral parts of Unix and Linux security models, which manage user permissions and privileges.

🧐 Why ?

Understanding EUID, RUID, and SUID is important as they are fundamental to Unix and Linux system security. They govern what actions a user or process can perform on the system, such as file access and system command execution. Without a proper understanding of these concepts, system administrators may inadvertently grant excessive permissions to users or processes, leading to potential security risks.

⛏️ How ?

EUID, RUID, and SUID are used in the following way: when a user logs into a Unix or Linux system, they are assigned a RUID and EUID that match their user ID in the system's user account database. The SUID is a special permission bit that can be set on executable files, allowing users to run the file with the permissions of the file's owner. For instance, if a file has the SUID bit set and is owned by the root user, any user who executes this file will have the same privileges as the root user for that execution.

⏳ When ?

The concepts of EUID, RUID, and SUID were introduced with the Unix operating system in the 1970s and continue to be used in Unix-like systems, including Linux and MacOS, today.

⚙️ Technical Explanations

Overview

In Unix-like operating systems, processes are governed by several user IDs that control their access to system resources. These user IDs include the Real User ID (RUID), Effective User ID (EUID), and Set User ID (SUID). Understanding these concepts is crucial for managing system security and permissions.

Key Concepts

1. Real User ID (RUID):
• The ID of the user who initiated the process.
• It remains constant for the life of the process.
• Used by the system to track the owner of the process and apply user-specific settings or restrictions.
2. Effective User ID (EUID):
• The ID used by the system to determine the process's access permissions.
• Can be different from the RUID, allowing processes to run with elevated privileges.
• Commonly used in conjunction with the SUID bit to grant temporary elevated permissions.
3. Set User ID (SUID):
• A special permission bit set on executable files.
• When a file with the SUID bit set is executed, the EUID of the process is set to the owner of the file.
• Enables users to execute tasks requiring higher privileges without having direct access to those privileges.

Practical Example: The passwd Command

Let's explore these concepts using the passwd command, which allows users to change their passwords. This command requires root privileges to modify the system's password file.

Scenario

1. Real User ID (RUID):
• User 'Alice' logs into the system with RUID 1001.
• Alice wants to change her password, so she runs the passwd command.
2. Effective User ID (EUID):
• The passwd command has its SUID bit set and is owned by root.
• When Alice runs passwd, the EUID for the process is temporarily set to 0 (root), enabling the necessary privileged operations.
3. Set User ID (SUID):
• The SUID bit allows the passwd command to run with root privileges, even though it was initiated by Alice (RUID 1001).

Command Line Example

1. Checking User IDs:
• Alice checks her user IDs using the id command:
Copy

alice$ id
uid=1001(alice) gid=1001(alice) groups=1001(alice)

• Output shows Alice's RUID is 1001.
2. Checking passwd Permissions:
• Alice checks the permissions of the passwd command:
Copy

alice$ ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 47032 May 16  2019 /usr/bin/passwd

• The 's' in the permissions field (rwsr-xr-x) indicates the SUID bit is set.
3. Executing passwd:
• When Alice runs passwd, the process runs with root privileges due to the SUID bit:
Copy

alice$ passwd

• During this execution, the process's EUID is 0 (root), allowing the necessary changes to the password file.

Security Implications

• Proper Use of SUID:
• Only trusted and essential system programs should have the SUID bit set.
• Misuse of the SUID bit can lead to significant security vulnerabilities, such as privilege escalation attacks.
• Audit and Monitoring:
• Regularly audit the system for files with the SUID bit set.
• Use commands like find to locate SUID files:
Copy

sudo find / -perm /4000 -type f -exec ls -l {} \\;

• Minimize SUID Usage:
• Restrict the use of SUID to the minimum necessary programs.
• Ensure that non-essential programs do not have the SUID bit set.

Conclusion

Understanding RUID, EUID, and SUID is essential for managing and securing Unix-like systems. The use of the SUID bit, while powerful, must be carefully controlled to prevent security vulnerabilities. By auditing and monitoring system permissions, administrators can mitigate the risks associated with elevated privileges and maintain a secure environment.

🖇️ References