Setgid - Revision history

Furey: Delinkify "shell script". It's commentary in a TODO, so we don't need to make a reference to explain it.

2024-06-18T14:16:17Z

Delinkify "shell script". It's commentary in a TODO, so we don't need to make a reference to explain it.

Aximili: put suggestion in a todo

2022-08-15T13:48:11Z

put suggestion in a todo

Phol ende wodan: add noversion template

2022-08-15T13:22:51Z

add noversion template

220.255.1.23 at 12:44, 9 October 2013

2013-10-09T12:44:21Z

Kernigh: Brief page discussing setgid on Unix.

2006-08-31T01:11:37Z

Brief page discussing setgid on Unix.

New page

{{man|setgid|2}}
[[NetHack]] needs to be able to write files into a directory called the [[playground]]. This is necessary to save games, to delete saved games when loading them, to save [[persistent level]]s during gameplay, to log games, and to add to the list of high scores. However, on multiuser [[Unix]] systems, users should not have write permision to the playground ''except'' when they play NetHack. Why let users cheat, or worse, corrupt the saves of other users?

The solution is to give write access for the playground not to the users, but to a special Unix group such as <tt>games</tt>. Then [http://www.freebsd.org/cgi/man.cgi?query=chown chown] the executable to user <tt>root</tt>, group <tt>games</tt> and set the '''setgid''' bit. When the game starts, the system will ''set'' the effective ''g''roup ''id'' to <tt>games</tt> and NetHack will have the priveleges necessary to write to the [[playground]].

This sort of arrangement dates back to [[Hack]], which needed this setup for the same reasons as NetHack does. Here is [[Hack 1.0.3]] upon [[User:Kernigh|Kernigh]]'s [[OpenBSD]] system:

$ ls -l /usr/games/hack
-r-xr-sr-x 1 root games 250568 Mar 1 2006 /usr/games/hack
$ ls -ld /var/games/hackdir
drwxrwxr-x 3 root games 512 Jul 18 15:50 /var/games/hackdir

(Perhaps someone should edit the page and provide this info for their NetHack installation. Note that the <tt>nethack</tt> command is a [[shell script]] and that the setgid executable might be in the playground somewhere.)

The "s" in "-r-xr-sr-x" indicates that '''setgid''' is set. The group of the setgid executable (here /usr/games/hack) and that of the playground (here /var/games/hackdir) must match.

[[Category:Development]]

@@ Line 11: / Line 11: @@
   drwxrwxr-x  3 root  games  512 Jul 18 15:50 /var/games/hackdir
-{{Todo|Perhaps someone should edit the page and provide this info for their NetHack installation. Note that the <tt>nethack</tt> command is a [[shell script]] and that the setgid executable might be in the playground somewhere.}}
+{{Todo|Perhaps someone should edit the page and provide this info for their NetHack installation. Note that the <tt>nethack</tt> command is a shell script and that the setgid executable might be in the playground somewhere.}}
 The "s" in "-r-xr-sr-x" indicates that '''setgid''' is set. The group of the setgid executable (here /usr/games/hack) and that of the playground (here /var/games/hackdir) must match.

← Older revision		Revision as of 13:22, 15 August 2022
Line 15:		Line 15:
	The "s" in "-r-xr-sr-x" indicates that '''setgid''' is set. The group of the setgid executable (here /usr/games/hack) and that of the playground (here /var/games/hackdir) must match.		The "s" in "-r-xr-sr-x" indicates that '''setgid''' is set. The group of the setgid executable (here /usr/games/hack) and that of the playground (here /var/games/hackdir) must match.

		+	{{noversion}}
	[[Category:Development]]		[[Category:Development]]

@@ Line 2: / Line 2: @@
 [[NetHack]] needs to be able to write files into a directory called the [[playground]]. This is necessary to save games, to delete saved games when loading them, to save [[persistent level]]s during gameplay, to log games, and to add to the list of high scores. However, on multiuser [[Unix]] systems, users should not have write permision to the playground ''except'' when they play NetHack. Why let users cheat, or worse, corrupt the saves of other users?
-The solution is to give write access for the playground not to the users, but to a special Unix group such as <tt>games</tt>. Then [http://www.freebsd.org/cgi/man.cgi?query=chown chown] the executable to user <tt>root</tt>, group <tt>games</tt> and set the '''setgid''' bit. When the game starts, the system will ''set'' the effective ''g''roup ''id'' to <tt>games</tt> and NetHack will have the priveleges necessary to write to the [[playground]].
+The solution is to give write access for the playground not to the users, but to a special Unix group such as <tt>games</tt>. Then [http://www.freebsd.org/cgi/man.cgi?query=chown chown] the executable to user <tt>root</tt>, group <tt>games</tt> and set the '''setgid''' bit. When the game starts, the system will ''set'' the effective ''g''roup ''id'' to <tt>games</tt> and NetHack will have the privileges necessary to write to the [[playground]].
 This sort of arrangement dates back to [[Hack]], which needed this setup for the same reasons as NetHack does. Here is [[Hack 1.0.3]] upon [[User:Kernigh|Kernigh]]'s [[OpenBSD]] system: