Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to create a ruby script that is executed with root permissions when run by an unprivileged user. Basically I'm writing a wrapper script that when run adds the user to a group, runs a command, then removed the user from the group. This is all under CentOS and not using sudo.

I've played around with having the script owned by root and then chmod +s which as I understand should run the script with root permissions. However when I run the ruby command system "gpasswd -a #{user} #{group}" in my script I get a permission denied message.

I'm a bit stuck now no how to get this working.

Thanks

share|improve this question

2 Answers 2

Setting scripts setuid doesn't work unless the interpreter has a setuid version which it invokes upon seeing the setuid script. You will need a compiled setuid wrapper to run the script.

Also, note that group membership changes don't take effect until the user relogs. Perhaps you should look at configuring usermode or PolicyKit instead.

share|improve this answer

Sudo is the right tool for the job, and you should consider installing it.

share|improve this answer
    
unfortunately sudo won't work in my situation as the software being used will install packages in the root location rather than the users home folder when run under sudo –  JamieD May 13 '11 at 9:40
    
You might want to explore the -u, -g, and -H options to sudo. There's more to sudo than just running things as root. It'll be a lot less of a headache than getting some setuid working with a script. –  Cakemox May 13 '11 at 9:46
    
Interesting, I've tried adding the following line to /etc/sudoers ausername ALL=NOPASSWD:/usr/local/bin/bundle which lets me run the command as sudo ok. Unfortunately when running it remotely how it would normally be done I'm getting permission errors make: execvp: gcc: Permission denied. I don't want users to be able to run gcc directly, only via the bundle command. Any ideas? –  JamieD May 13 '11 at 14:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.