Hello,
The manual page for chown(1) notes:
The ownership of a file may only be altered by a super-user for
obvious security reasons.
Unless invoked by the super-user, chown clears the set-user-id and
set-group-id bits on a file to prevent accidental or mischievous
creation of set-user-id and set-group-id programs.
I observe:
$ ls -l a.out
-rwsr-xr-x 1 root wheel 10468 Sep 18 16:59 a.out
$ sudo chown nobody a.out
$ ls -l a.out
-rwxr-xr-x 1 nobody wheel 10468 Sep 18 16:59 a.out
Two questions:
(1) If chowning files is only possible by the super-user ("for obvious
security reasons"), then why do we bother explicitly noting that "Unless
invoked by the super-user..." it clears the setuid bits? Isn't the
"Unless" clause redundant if chown(1) cannot succeed without super-user
privs anyway?
(2) It looks to me that chown(1) clears the setuid bits even _if_
invoked by the super-user, and as described in chown(2).
(I note that on OS X, this is not the case, where chown(1) does indeed
retain setuid bits if invoked with super-user privs.)
Should the manual page read:
The ownership of a file may only be altered by a super-user for
obvious security reasons.
Upon success, chown clears the set-user-id...
?
-Jan
