Date: Fri, 25 Jul 2003 06:27:31 +0200
From: Lionel Elie Mamane <lionel at mamane lu>
Subject: Re: running s scsh script with changed user and group id
Message-ID: <20030725042731.GB10586 at tofu home mamane lu>
On Thu, Jul 24, 2003 at 05:27:10PM +0200, Sven.Hartrumpf at FernUni-Hagen de w=
rote:
> I need to run a scsh script with changed user id and group id
> The naive way is:
> chmod 755 myscript
> chmod u+s myscript
> chgrp g+s myscript
> This doesn't work
Indeed, Linux doesn't honour set{g,u}id bits on #!-scripts.
> What is the recommended way to achieve my goal?
Use a wrapper written in C (or another compiled language) that
exec()'s your script (or "scsh -s yourscript"), and install that
wrapper set{u,g}id.
Another solution is using something like super or sudo. That's in fact
exactly what they were created to do. From the description of super:
It is intended to be a secure alternative to making scripts setuid.
With these tools, you can choose who can execute what script (or more
generally command) under what uid/gid. In some sense, they are
"configurable wrappers". The call to sudo/super can itself be wrapped
into a shell script, bringing us to three exec()'s just to launch the
script.
(apply exec-path `("sudo" "-u" uid "yourscript" . ,command-line-arguments))
--
Lionel
Up |