in reply to Re: Perl script needs root privilegies
in thread Perl script needs root privilegies

SUDO would be nice if I had only iptables. But this script uses a whole bunch of programs, not only iptables. I can't write them all down to /etc/sudoers ;)
I thought there is some generic perl way to change uid?
  • Comment on Re^2: Perl script needs root privilegies

Replies are listed 'Best First'.
Re^3: Perl script needs root privilegies
by tirwhan (Abbot) on Dec 26, 2005 at 11:49 UTC
    I can't write them all down to /etc/sudoers

    Umm, why not? This is an extremely flexible and comfortable way of granting minimum necessary privileges (you can even give users the ability to run commands as other users, not root, or use one sudoers file for several systems, specifying which capabilities are allowed on which systems). Why would you not want to do this the most secure way possible (given that what you're trying to do is risky at best anyway)?

    I thought there is some generic perl way to change uid?

    Sorry, I'm not in the business of promoting bad practices (and I consider suidperl to be a bad practice :-).

    If you're calling lots of external commands, the best thing would be to condense these into one or several shell scripts (taking care to make the scripts do as little as possible, be as unambiguous as possible and require as few passed parameters as possible) and then make the script callable by sudo.


    A computer is a state machine. Threads are for people who can't program state machines. -- Alan Cox
      Ok, lets say you convinced me for now ;)
      I had in mind that there must be another way to make that. I'm not against sudo, I use it for a cople of another scripts. I thought that it will be dangerous overcrouded there if I add all needed programs for that script there.
Re^3: Perl script needs root privilegies
by Corion (Patriarch) on Dec 26, 2005 at 11:44 UTC

    You can change your uid in Perl by using POSIX::setuid, but setting your userid only works if you are already on uid 0. Also, using setuid programs or scripts is a dangerous practice, so I would try to limit what needs to be done by root as much as possible.