Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

On rhel5-6 I need to find a way to effectively call seteuid() for a process as a user that is not a super-user. In addition, I would also like to be able to control which uids for which calls to seteuid() will be successful, for a given user. I'm fairly certain that nothing like this is baked in to rhel, and I've been told that it is impossible without creating a kernel module. Is anyone aware of such a module already in development?

EDIT: The purpose of setting the effective uid of a process (without forking) is to write files owned by other users in the same group from a generic process (rather than forking and sudo-ing).

share|improve this question
1  
What is it you are ACTUALLY trying to do? Perhaps we could suggest a much simpler way to fix the real problem. See XY Problem – Grant Jul 18 '12 at 15:55
There is also a setuid/setgid selinux capability, so it could be managed by creating a policy for the process, if one doesn't exist already. And if you are using selinux. – lsd Jul 18 '12 at 19:44
@lsd Can you provide a link to some documentation about that capability of selinux? I'm not using selinux, but I'd like to see how it's accomplished. – gred Jul 19 '12 at 12:50
Here is a brief message about it, sort of: comments.gmane.org/gmane.linux.redhat.fedora.selinux/673. There isn't really a lot out there about it. I found out from looking at the policy source. However, it doesn't really restrict what users a program can setuid to, only if it can setuid. root effectively can setuid to any user. Perhaps an alternative would be to use sudo instead to allow a user to sudo to a specific other set of users to run the program. That way the program will always have the correct user. – lsd Jul 19 '12 at 13:12
we'll probably end up using sudo, but the problem with that is that we have to fork to use sudo, and this is something we'll need to do frequently, so we'll have to use daemon processes, which is a little awkward. – gred Jul 20 '12 at 13:55

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.