本文的主線 準備 => setuid => sticky
準備
vim app.js
var fs = require('fs')
fs.writeFile('app.txt', 'hello node', function() {
console.log('finish')
})
setuid
setuid: run with the privileges of the file owner
whoami
# op
ls -l `which node`
# -rwxr-xr-x 1 op op 45626872 Jan 7 2020 /home/op/.nvm/versions/node/v12.14.1/bin/node
node app.js
# finish
ls -l app.txt
# -rw-rw-r-- 1 op op 10 Mar 11 20:36 app.txt
sudo chown root:root `which node`
ls -l `which node`
# -rwxr-xr-x 1 root root 45626872 Jan 7 2020 /home/op/.nvm/versions/node/v12.14.1/bin/node
node app.js
# finish
ls -l app.txt
# -rw-rw-r-- 1 op op 10 Mar 11 20:42 app.txt
sudo chmod u+s `which node`
sudo chmod 4755 `which node`
ls -l `which node`
# -rwsr-xr-x 1 root root 45626872 Jan 7 2020 /home/op/.nvm/versions/node/v12.14.1/bin/node
node app.js
# finish
ls -l app.txt
# -rw-rw-r-- 1 root op 10 Mar 11 21:10 app.txt
系統應用: sudo
sudo chown `whoami`:`whoami` `which node`
ls -l `which node`
# -rwxr-xr-x 1 op op 45626872 Jan 7 2020 /home/op/.nvm/versions/node/v12.14.1/bin/node
id
# uid=1000(op) gid=1000(op) groups=1000(op),27(sudo)
ls -l `which sudo`
# -rwsr-xr-x 1 root root 149080 Feb 1 2020 /usr/bin/sudo
sudo `which node` app.js
# finish
ls -l app.txt
# -rw-r--r-- 1 root root 10 Mar 11 21:12 app.txt
sticky
sticky: the files in that directory can only be removed by the owner
whomai
# op
mkdir public
touch public/op.txt
ls -l public
# -rw-rw-r-- 1 op op 0 Mar 11 21:19 op.txt
sudo useradd other
sudo su other
touch /home/op/public/other.txt
# touch: cannot touch '/home/op/public/other.txt': Permission denied
exit
chmod 777 public
sudo su other
touch /home/op/public/other.txt
ls -l /home/op/public
# -rw-rw-r-- 1 op op 0 Mar 11 21:19 op.txt
# -rw-rw-r-- 1 other other 0 Mar 11 21:22 other.txt
rm /home/op/public/op.txt
whoami
# op
chmod +t public
chmod 1777 public
ls -l
# drwxrwxrwt 2 op op 4096 Mar 11 21:25 public
touch public/op.txt
ls -l public
# -rw-rw-r-- 1 op op 0 Mar 11 21:26 op.txt
sudo su other
rm /home/op/public/op.txt
# rm: cannot remove '/home/op/public/op.txt': Operation not permitted
系統應用: /tmp
whoami
# op
ls -l / | grep tmp
# drwxrwxrwt 11 root root 4096 Mar 11 21:26 tmp
touch /tmp/op.txt
ls -l /tmp/*.txt
# -rw-rw-r-- 1 op op 0 Mar 11 21:29 /tmp/op.txt
sudo su other
rm /tmp/op.txt
# rm: cannot remove '/tmp/op.txt': Operation not permitted