up vote 0 down vote favorite
share [g+] share [fb]

I'm trying to create a ruby script that is executed with root permissions when run by an unprivileged user. Basically I'm writing a wrapper script that when run adds the user to a group, runs a command, then removed the user from the group. This is all under CentOS and not using sudo.

I've played around with having the script owned by root and then chmod +s which as I understand should run the script with root permissions. However when I run the ruby command system "gpasswd -a #{user} #{group}" in my script I get a permission denied message.

I'm a bit stuck now no how to get this working.

Thanks

link|improve this question
feedback

2 Answers

up vote 4 down vote

Setting scripts setuid doesn't work unless the interpreter has a setuid version which it invokes upon seeing the setuid script. You will need a compiled setuid wrapper to run the script.

Also, note that group membership changes don't take effect until the user relogs. Perhaps you should look at configuring usermode or PolicyKit instead.

link|improve this answer
feedback
up vote 3 down vote

Sudo is the right tool for the job, and you should consider installing it.

link|improve this answer
unfortunately sudo won't work in my situation as the software being used will install packages in the root location rather than the users home folder when run under sudo – JamieD May 13 '11 at 9:40
You might want to explore the -u, -g, and -H options to sudo. There's more to sudo than just running things as root. It'll be a lot less of a headache than getting some setuid working with a script. – Cakemox May 13 '11 at 9:46
Interesting, I've tried adding the following line to /etc/sudoers ausername ALL=NOPASSWD:/usr/local/bin/bundle which lets me run the command as sudo ok. Unfortunately when running it remotely how it would normally be done I'm getting permission errors make: execvp: gcc: Permission denied. I don't want users to be able to run gcc directly, only via the bundle command. Any ideas? – JamieD May 13 '11 at 14:48
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.