{"id":17223483,"url":"https://github.com/aichingm/suidwgen","last_synced_at":"2026-04-26T20:31:48.880Z","repository":{"id":84430497,"uuid":"134482175","full_name":"aichingm/suidwgen","owner":"aichingm","description":"Set uid wrapper generator","archived":false,"fork":false,"pushed_at":"2018-05-22T22:24:47.000Z","size":16,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-06-02T14:17:32.830Z","etag":null,"topics":["linux","root-privileges","setuid","wrapper"],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aichingm.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-05-22T22:21:36.000Z","updated_at":"2025-02-21T15:50:26.000Z","dependencies_parsed_at":"2023-03-12T22:58:02.054Z","dependency_job_id":null,"html_url":"https://github.com/aichingm/suidwgen","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/aichingm/suidwgen","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aichingm%2Fsuidwgen","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aichingm%2Fsuidwgen/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aichingm%2Fsuidwgen/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aichingm%2Fsuidwgen/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aichingm","download_url":"https://codeload.github.com/aichingm/suidwgen/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aichingm%2Fsuidwgen/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32312225,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T19:15:34.056Z","status":"ssl_error","status_checked_at":"2026-04-26T19:15:15.467Z","response_time":129,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["linux","root-privileges","setuid","wrapper"],"created_at":"2024-10-15T04:08:27.373Z","updated_at":"2026-04-26T20:31:48.845Z","avatar_url":"https://github.com/aichingm.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SUIDWGEN\n\n_setuid wrapper generator_\n\n## Requirements\n\n* gcc\n* sudo\n* openssl (optional for hash protection) \n\n## Installation\n\nNo installation needed, just checkout this repository!\n\n## Generating a wrapper\n\nTo generate a wrapper run:\n\n```shell\nmake warpper SCRIPT=super-secure.php INTERPRETER=/usr/bin/php\n```\n\nYou can configure a bunch of checks done by the wrapper by passing flags to `make` : see the section below. After the first step you will have three new files. Named  `super-secure.php-root` ,     `super-secure.php-root-wrapper.c`  and  `super-secure.php-root-wrapper`.\n\nNow you have to prepare the script you want to be run as privileged user, this can be done via `make`:\n\n```shell\nmake secure SCRIPT=super-secure.php\n```\n\n_Note: you can change the owner and group of the script and wrapper by passing `USER=someuser` to `make`_ \n\nor manually:\n\n```shell\nchmod 700 [super-secure.php] #this will prevent normal users from running and changing the script\nchown root:root [super-secure.php] # root or any other privileged user:group\n```\n\n__NOTE:__ it is super important that normal users are unable to change the script!\n\nAfter this is done you have to configure the wrapper:\n\n```shell\nchmod 711 [super-secure.php-root-wrapper]\nchmod a+s [super-secure.php-root-wrapper] # this will set the uid bit\nchmod u+rwx [super-secure.php-root-wrapper]\nchown root:root [super-secure.php-root-wrapper] # root or any other privileged user:group\n```\n\nNow you should be able to call `./super-secure.php-wrapper` with your unprivileged user and run your `[super-secure.php]` script as root or any other user. \n\n### Flags \u0026 Wrapper Checks\n\nYou can configure the wrapper by passing flags like this:\n\n```shell\nmake wrapper CHECK_SCRIPT_NOT_WRITABLE=1\n```\n\nThe flags are:\n\n* CHECK_SCRIPT_NOT_WRITABLE `1` or `0`: Check if the script is not writable by any one but the owner.\n*  CHECK_SCRIPT_NOT_READABLE `1` or `0` : Check if the script is not readable by any one but the owner.\n* CHECK_SCRIPT_ONLY_USR_EXEC `1` or `0`: Check if the script is only executable by the owner.\n* CHECK_SAME_OWN  `1` or `0`: Check if the script and the wrapper have the same owner.\n* CHECK_SAME_GRP  `1` or `0`: Check if the script and the wrapper have the same group.\n* CHECK_NOT_ROOT_U  `1` or `0`: Check if the owner is not root, this is disabled by default.\n* CHECK_NOT_ROOT_G  `1` or `0`: Check if the group is not root, this is disabled by default.\n* CHECK_HASH  `1` or `0`: Check if the hash of the file matches a precalculated hash.\n* CHECK_MAX_ARGS `1` or `0`: Check the number of arguments passed to the script.\n* MAX_ARGS  a number `0` to `1000`: This settings depends on __CHECK_MAX_ARGS__. Limit the number of arguments passed to the script to a positive integer. \n* UNSET_ENV `1` or `0`: Unset the environment for the script.\n* __DEBUG__ `1` or `0`: This is disabled by default. Set it to 1 to get some error logging.\n* __USER__ a `username` Change the user under which the wrapper will be executed. Default is `root`.\n\n### Example \n\nRun:\n\n```shell\nmake all SCRIPT=\"example/script.php\" INTERPRETER=/usr/bin/php ; ./example/script.php-root-wrapper \";)\"\n```\n\n## Wrapper Return Codes\n\n* 0 Everything is cool\n\n* 1: More then MAX_ARGS arguments are passed to the wrapper.\n\n* 4: Failed to set the uid.\n\n* 5: Failed to set the gid.\n\n* 6: The script is writable by other users then the owner.\n\n* 7: The script is readable by other users then the owner.\n\n* 8: The script is executable by other users then the owner.\n\n* 9: The owners of the script and the wrapper are differing.\n\n* 10: The group of the script and the wrapper are differing.\n\n* 11: The wrapper does not run as user root.\n\n* 12: The wrapper does not run as group root.\n\n* 13: Failed to hash the script.\n\n* 14: The hash of the script and the stored hash in the wrapper are differing. \n\n* 15: Failed to open the script for reading.\n\n* \\\u003e 100: Use this error range indicate errors thrown from the script. \n\n* \\\u003e 200\n\n  ​\n\n  ​\n\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faichingm%2Fsuidwgen","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faichingm%2Fsuidwgen","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faichingm%2Fsuidwgen/lists"}