0

I want to be able to run fdisk -l as any user, without getting the whole fdisk: cannot open /dev/sda: Permission denied message.

I don't see how fdisk -l can be used for malicious purposes.

I have a PHP script, which first checks if the user is logged into my website, and if they are admin.

Then I have an admin control panel, where it shows the output of fdisk -l, however, I am getting the error fdisk: cannot open /dev/sda: Permission denied.

There is no user input, so they can't inject arguments into the command.

Jacob Collins
  • 1

1 Answers1

0

A solution would be to create a program calling fdisk. Writing it in C\C++ would be easy, you just need a compiler. Then change the owner of the executable to root and give it the SUID right (giving the SUID to a script won't work that's why you'll need an executable not a script). Make sure no other user can write to that file or it could cause a security issue.

dev93
  • 161