RFD: remove suid_exec?

[McDutchie]

See here for info on suid_exec.

All my attempts to have ksh actually execute a setuid shell script as root with the help of suid_exec on macOS and Linux have been unsuccessful. It may be this simply no longer works on modern operating systems. Maybe I'm doing it wrong though. Has anyone got this to work?

I'm not aware of any distributions that ship suid_exec.

The whole idea of setuid shell scripts seems completely outmoded and obsolete. AFAIK, they're simply not a good idea.

Perhaps we should simply remove suid_exec.

Opinions? (ping @JohnoKing, @hyenias, anyone who wants to weigh in)

[JohnoKing]

The following links are relevant to the discussion:
att#366
https://unix.stackexchange.com/questions/364/allow-setuid-on-shell-scripts

IMO, the suid_exec utility is deadweight and is better off removed from the codebase. Almost no one uses it and it's redundant anyways. If I want to run a script as root or a different user, I'm going to use sudo, not suid_exec.

[hyenias]

Agreed. After researching ksh's suid_exec program, I recommend removing it completely for security concerns (CVE-1999-1114) and as mentioned there are more common ways to run as root (sudo, doas, and su).

[McDutchie]

That CVE is from 1999 so the issue was likely fixed well before 2012. But a more general point stands: suid_exec may well have undiscovered security problems as it's essentially unmaintained. Another reason to get rid.

[McDutchie]

Done in 09811da (dev), b4e7350 (1.0)