Programs With Borrowed Power

One letter, full control

Some programs are set to run as their owner rather than as the person who started them. If the owner is root, that program has full control of the machine no matter who runs it.

You can see it in a listing. Look for an s where the x normally is:

-rwsr-xr-x  1 root root  /usr/bin/passwd
   │
   └── an s here instead of an x

Why some of them are fine

passwd needs this. Changing your password means writing to a file ordinary users cannot touch, so it runs as root, does that one job, and refuses everything else. That is the safe version.

The problem is when this is set on a program that can do anything, such as a text editor, a search tool, or anything that can run other commands. Then whatever it runs also runs as root, and the machine is wide open.

Find them

sudo find / -perm -4000 -type f 2>/dev/null

That lists every program set up this way. Most of what comes back is normal. Compare it against this:

Fix it

sudo chmod u-s /path/to/program

Then list it again and check the s has become an x.

💡 Do not strip every one you find. Take the bit off the programs in the right-hand column only. Remove it from sudo or passwd and nobody can become an administrator or change a password, on a machine where the root account is probably locked.

Try it yourself

sudo find / -perm -4000 -type f 2>/dev/null     # the full list
ls -l /usr/bin/find /usr/bin/passwd              # compare the two