2

When I was studying the manual page for command pmount I read the following:

pmount ("policy mount") is a wrapper around the standard mount program which permits normal users to mount removable devices.

And when I used pmount /dev/sdc1 (without sudo) as a normal user, it created a folder named /media/sdc1 folder, while the permissions for the system's /media folder are drwxr-xr-x and it is owned by root. This means that a normal user (currently, me) cannot create files and folders in /media folder.

Doesn't this contradict the rules of permissions and ownership in Linux?

Another question is that while mount requires superuser permissions, and pmount uses mount internally, how is it possible to use pmount without sudo?

Improve this question

1 Answer 1

Reset to default
4

/usr/bin/pmount is a setuid binary. When running a setuid executable, the uid or gid is changed to executable's owner. When executing pmount, the process will have root privileges and can therefore create root owned directories and mount filesystems.

Same setuid mechanism also applies to sudo.

Improve this answer
4
  • Then doesn't this decrease the security of the system? Should I remove "pmount" package and its dependeicnes? Commented Aug 4, 2017 at 10:06
  • @Hedayat Yes, setuid binaries can be used by attackers and decrease the security of the system. But without them, you wouldn't be able to do things like change your own password since your password is usually stored securely so normal users can't even read the storage. Some required actions on a system may only be done by setuid binaries - such as using the already-mentioned sudo to change to another user. If users need to do what pmount provides, you'll need to keep it. If they don't, yes you would make your system a bit more secure by removing the package. Commented Aug 4, 2017 at 10:26
  • Thank you dear Andrew. How can I understand whether a command is a setuid binary or not? Commented Aug 4, 2017 at 10:38
  • You can inspect executables /bin /usr/bin with ls -l to see if the setuid/setgid bits are set. If you want to find all files with setuid or setgid bit set you can do that using find eg. find / -perm /6000. Commented Aug 4, 2017 at 12:21

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.