[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Prevent chown to remove the setuid bit



On 27/11/25 at 00:13, Andy Smith wrote:
Hi,

On Wed, Nov 26, 2025 at 08:39:43PM +0100, Franco Martelli wrote:
Is it possible to change the group owner keeping the permissions of the file
in its place?

I don't think so because it's the kernel that's enforcing this in the
system call. On user or group change it's clearing setuid, setgid and
all capabilities.

Is there a reason why you can't read the setuid/setgid bits before and
restore them after?

I've an issue with VirtualBox 7.2, it doesn't start the VMs from the CLI (virtualboxvm command), so I want to try to change the group owner to "vboxusers" of all the files listed in the "/usr/lib/virtualbox" directory recursively.

The number of files to restore after changing the group owner it is not so much:

~$ ls -Rlh /usr/lib/virtualbox/ | grep 'r-s'
-r-s--x--x 1 root root 139K 17 ott 13.40 /usr/lib/virtualbox/VBoxHeadless -r-s--x--x 1 root root 31K 17 ott 13.40 /usr/lib/virtualbox/VBoxNetAdpCtl -r-s--x--x 1 root root 139K 17 ott 13.40 /usr/lib/virtualbox/VBoxNetDHCP
-r-s--x--x 1 root root      139K 17 ott 13.40 /usr/lib/virtualbox/VBoxNetNAT
-r-s--x--x 1 root root 15K 17 ott 13.40 /usr/lib/virtualbox/VBoxVolInfo -r-s--x--x 1 root root 143K 17 ott 13.40 /usr/lib/virtualbox/VirtualBoxVM


therefore I can restore their permissions manually, I asked because I was thinking that maybe there is an official way to accomplish this. Do you suggest to write a bash shell script?

Cheers,
--
Franco Martelli


Reply to: