Can the user a script runs as be changed?

theAcolyte has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: Can the user a script runs as be changed? by tachyon (Chancellor) on Jul 02, 2004 at 03:24 UTC
You can use a suid perl/apache but don't do it that way. The best way (IMHO) is to give the web server process permission to execute the program via sudo/sudoers. For example [root@devel3 log]# cat /etc/sudoers # sudoers file. # This file MUST be edited with the 'visudo' command as root. # See the sudoers man page for the details on how to write a sudoers f +ile. # let apache send HUP to squid apache ALL=NOPASSWD:/home/www/utility/sendHUP.pl [root@devel3 log]# ll /home/www/utility/sendHUP.pl -rwxr-xr-x 1 apache coders 1114 Mar 10 02:43 /home/www/util +ity/sendHUP.pl [root@devel3 log]# cat /home/www/utility/sendHUP.pl #!/usr/bin/perl -w # this script need to be run as root, to do this we add an entry to # /etc/sudoers so that apache can run it (you edit using visudo) # visudo -f /etc/sudoers # add this line # apache ALL=NOPASSWD:/home/www/utility/sendHUP.pl # call as system('sudo', '/home/www/utility/sendHUP.pl'); (kill HUP, $PROGRAM) or exit 42; exit 0; [download] My webserver runs as apache, but yours may be nobody or something else. What the line in sudoers does is allow apache to potentialy run the sendHUP.pl with root privileges. This is required to send (in this case squid) a HUP signal. Note that the actual sendHUP.pl script is not owned by root or suid. It is just a normal script. Note also you need to call this with `system( 'sudo', '/some/prog.pl' )` from within your script to execute the program with root privilege. So by using sudo/sudoers you can limit the webserver to being able to execute as little as a single command/program as root which is better than letting it be able to execute lots of stuff which is quite possible if you go the suid root (route ;-) cheers tachyon	[reply] [d/l] [select]
Re^2: Can the user a script runs as be changed? by Nkuvu (Priest) on Jul 02, 2004 at 04:12 UTC
Note that you can find out what user Apache runs as by looking in the httpd.conf file (mine's located at /etc/httpd/httpd.conf) and looking for lines like `User www Group www` [download] Obviously Apache runs as www for me.	[reply] [d/l]
Re^3: Can the user a script runs as be changed? by tachyon (Chancellor) on Jul 02, 2004 at 04:19 UTC
grep "^User " `locate httpd.conf`	[reply] [d/l]
Re: Can the user a script runs as be changed? by ercparker (Hermit) on Jul 02, 2004 at 03:48 UTC
something else you can do as far as changing the user a script is running as: `my ($login,$pass,$uid,$gid) = getpwnam('username'); $) = $gid; $> = $uid; #now it should be running as username` [download] This probably won't be applicable in this case but its good to know as an FYI	[reply] [d/l]
Re: Can the user a script runs as be changed? by nightwatch (Scribe) on Jul 02, 2004 at 03:11 UTC
See the manual page of the `chmod` command for information regarding the setuid bit, which will automatically bump your script up to root (or, more accurately, the owner of the file) whenever it's run. This is what the "s" means in a set of permission flags in a "ls -l" listing. perlsec has some good information on setuid scripts; you almost certainly want them to run with taint mode on.	[reply]
Re^2: Can the user a script runs as be changed? by tachyon (Chancellor) on Jul 02, 2004 at 03:44 UTC
This is IMHO bad advice. Firstly it simply won't work for many configurations and secondly suid root and web servers are a dangerous combination - especially if someone needs to have suid explained to them. There are other, safer ways to skin this particular cat.	[reply]
Re^3: Can the user a script runs as be changed? by nightwatch (Scribe) on Jul 02, 2004 at 04:18 UTC
The original author didn't specify whether it was running on a web server or not - the instance of a CGI script hadn't occurred to me actually. Yes, CGI scripts shouldn't be run suid root. Perhaps the author could clarify?	[reply]
Re^4: Can the user a script runs as be changed? by tachyon (Chancellor) on Jul 02, 2004 at 04:23 UTC
Re^3: Can the user a script runs as be changed? by Lexicon (Chaplain) on Jul 04, 2004 at 17:44 UTC
Just because it's dangerous isn't a reason not to teach it to them. Everyone has to learn about it for the first time sometime. It is responsible to give them the "But don't do that." disclaimer, though. Lexicon	[reply]
Re^4: Can the user a script runs as be changed? by tachyon (Chancellor) on Jul 04, 2004 at 23:58 UTC
Re^5: Can the user a script runs as be changed? by Lexicon (Chaplain) on Jul 15, 2004 at 18:51 UTC
Some notes below your chosen depth have not been shown here
Re: Can the user a script runs as be changed? by jacques (Priest) on Jul 02, 2004 at 03:58 UTC
I'm root on the system Scary.	[reply]
Re: Can the user a script runs as be changed? by Anonymous Monk on Jul 02, 2004 at 17:30 UTC
Depending upon your needs I'd give this general generic advice: You can set the SUID or equivalent for the group of the script to allow it to run as another user. I'd try to stay away from this as much as possible, but if you do, ALWAYS use tainting checking to verify your input. If your script is a cgi script, consider writing a go-between script elswhere on the system that is SUID and not viewable directly by the webserver.	[reply]