Subject: [Dev] setuid question

From: "Peter Long" <[email-masked]>
Date: Wed, 13 Aug 2003 10:22:52 -0400 (EDT)

Hi all,

I am trying to setup a daemon that I wrote so that it runs under its own
userid (with restricted privileges). I also want to create a user group
that has permission to start and stop the daemon.

I tried using 'chmod 6550' to set the uid and gid bits. This results in
the effective user id and group id being set appropriately. However the
real user id and group id is still the same as that of the user that
started the daemon. Consequently only that user can send a SIGTERM signal
to the process.

I know that this must be something that has been done before and that
there is a right way and a wrong way to do it. I am most likely doing it
the wrong way.

Any pointers in the right direction would be appreciated.

--
Peter Long

---

From: Jon Carnes <[email-masked]>
Date: Wed, 13 Aug 2003 14:48:49 -0000

I'm sure you will get a better answer from someone, but when I write a
small stand-alone program and I want it to execute as the user (owner)
then use the setUID bit.

When I'm programming in Python I use something like:
  import os

  def check_privs():
    # If we're running as root (uid == 0), then set the uid and gid
    # to configured values
    gid = grp.getgrnam(Prog_cfg.PROG_GROUP)[2]
    uid = pwd.getpwnam(Prog_cfg.PROG_USER)[2]
    myuid = os.getuid()
    if myuid == 0:
        os.setgid(gid)
        os.setuid(uid)
    elif myuid <> uid:
        name = Prog_cfg.PROG_USER
        usage(1, _(
            'Run this program as root or as the %(name)s user.'))

Hope this is helpful!

Jon Carnes  

On Wed, 2003-08-13 at 10:22, Peter Long wrote:
> _______________________________________________
> Dev mailing list
> [email-masked]
> http://www.trilug.org/mailman/listinfo/dev

---

From: "Scott Lundgren" <[email-masked]>
Date: Wed, 13 Aug 2003 11:51:55 -0400

>Any pointers in the right direction would be appreciated.

Since you've created a user and a group to run the daemon, and you want that
user to own the process why not look at how the /etc/rc.d/init.d scripts are
written ?

---

From: "Peter Long" <[email-masked]>
Date: Thu, 14 Aug 2003 10:48:26 -0400 (EDT)

Scott Lundgren said:
>> there is a right way and a wrong way to do it. I am most likely doing
>> it the wrong way.
>>
> Since you've created a user and a group to run the daemon, and you want
> that user to own the process why not look at how the /etc/rc.d/init.d
> scripts are written ?

Scott and Jon,

Thanks for the help. Not surprisingly there seems to be several ways to do
this. Also it seems that I cannot do exactly what I was hoping to do.
Which was to allow anyone in a particular group to kill the process. I
will have to beg the administrator to give us sudo rights to kill it.

Jon, is there any particular advantage to using setuid() in the code
versus using chmod 6xxx on the binary? It seems to result in the same
thing.

-- 
Peter Long