Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our company's server is running Ubuntu 12.04 (Precise) and Apache 2. We have a custom, internal web application installed. I have a bash script which pulls any updates to that app from source control to the server. Only one user on the system (the owner of the script file) has the necessary SSH keys to connect to source control, but I would like any user on the system to be able to run this script to update the application.

I've done some research, and it looks like this is exactly the purpose for which the setuid bit was designed, so that any user on the system could run the script and the script would run with the user id of the owner of the script. However, it seems that modern distros ignore the setuid bit for scripts, because of the security risks posed if a script owned by root was executed.

I thought I could get around this for a while by making it a perl script, but as of Precise, there is no suid-perl package anymore either. It looks like this has been deprecated.

I found some sites that recommend getting around this by adding the users to the sudoers file, but my script doesn't require root permissions to run, and it doesn't make any changes to any part of the filesystem except the website, so I'd rather not grant anyone sudoer privileges. The script just requires the permissions of the script owner to run properly.

So, what is the preferred, modern approach to executing a script with the UID of a (different, non-root, non-sudo) user?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

You can configure sudo to allow people to run a command as a specific no root user too e.g. in sudoers

user1   (ALL) = (appuser) /path/to/yourapp

would allow the user user1 to run your app as appuser with

sudo -u appuser /path/to/yourapp

Similarly

%somegroup    (ALL) = (appuser) /path/to/yourapp

in sudoers would allow the users in the group somegroup to run you app as appuser with

sudo -u appuser /path/to/yourapp
share|improve this answer
    
Thanks for the answer. Will this approach prompt user1 for appuser's password? (Will it prompt user1 for their own?) –  Jazz Jun 12 '12 at 17:03
    
It will prompt the user for their own password and log their actions in the way that sudo normally does. –  Iain Jun 12 '12 at 17:05
    
Thanks again. Worked perfectly. (And I got to learn about Cmnd_Aliases too.) –  Jazz Jun 13 '12 at 14:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.