Saved has asked for the wisdom of the Perl Monks concerning the following question:

I was in Tech. Support, and had root access. I was moved to Security, and it was deemed advisable for me to have only read only at the shell. Through sudo, I can use commands like ls or ll as root. I have been getting more and more into perl however, and would like to know if there is a way to allow perl constructs such as if(-f $FILE) or (-e $FILE) and any other read only varients to be given root privilege? Thanx

Replies are listed 'Best First'.
Re: perl file status and sudo
by aaron_baugher (Curate) on Mar 22, 2012 at 14:24 UTC

    See perldoc perlvar for the variable $>, which can be set to 0 to change your effective user to root. However, (and I'm not a sudo expert), I believe this will require that the admins allow you to use Perl as root, which basically means letting you do anything as root, which they don't appear to want to do. I don't know if there's a way to lock Perl down so you can only do things like testing file existence as root, but not things like system('rm -rf /');.

    I'd add that if they want you to have read access to some files, there are better ways to do that than giving you sudo to root for certain commands. It'd probably make more sense to set global or group execute permission on the directories in question and read permission on the files, and not involve root access at all. An awful lot of seemingly harmless commands can be dangerous when run as root by someone who knows what he's doing (or doesn't).

    Aaron B.
    My Woefully Neglected Blog, where I occasionally mention Perl.

[reply]
[d/l]
[select]
Re: perl file status and sudo
by JavaFan (Canon) on Mar 22, 2012 at 13:07 UTC
    Maybe. For general things, that depends on your OS. Some OSses can give users roles, and you really fine-tune, which system calls may be executed by whom.

    To give read only access one some file to some people, one can use ACLs, which is implemented on many OSses. To check if a file exists, one would have to be given read/exec access to the directory. And you need read access to the file to determine whether it's a file, or something else.

    If it comes to -x and frieds, ACLs aren't going to help you, as they look at the permission bits.

    Now, for the given problem, I don't understand why you need more than read-only rights. All you need for -f and -e is read only access anyway.

[reply]
[d/l]
[select]

      Thank You. We use HP-UX and RHEL linux. I do not need more than read-only access. I just would like to use perl only, and not bounce to the shell if not required.

[reply]
        I'm confused. Are you saying you can do if [ -f file ] in the shell, but not if (-f "file") from a Perl program?
[reply]
[d/l]
[select]

Back to Seekers of Perl Wisdom