Re: Inconsistency between os.getgroups and os.system('groups') after os.setgroups()

From	jeff <3beezer@gmail.com>
Newsgroups	comp.lang.python
Subject	Re: Inconsistency between os.getgroups and os.system('groups') after os.setgroups()
Date	2012-03-26 07:41 -0700
Organization	http://groups.google.com
Message-ID	<1229886.3.1332772897822.JavaMail.geo-discussion-forums@ynbp21> (permalink)
References	<19158239.1073.1332711120749.JavaMail.geo-discussion-forums@ynlx41> <mailman.973.1332713242.3037.python-list@python.org> <7418918.681.1332718439318.JavaMail.geo-discussion-forums@yneo2> <87ty1cgqj1.fsf@benfinney.id.au>

Show all headers | View raw

On Sunday, March 25, 2012 6:22:10 PM UTC-6, Ben Finney wrote:
> jeff writes:
> 
> > On Sunday, March 25, 2012 4:04:55 PM UTC-6, Heiko Wundram wrote:
> > > Am 25.03.2012 23:32, schrieb jeff:
> > > > but I have to be able to get back to root privilege so I can't use
> > > > setgid and setuid.
> > > 
> > > Simply not possible (i.e., you can't drop root privileges, be it by 
> > > setuid()/setgid() or removing yourself from groups with setgroups()), 
> > > and later reacquire them _in the same process_. See the discussion of 
> > > how to implement privilege separation at
> > > 
> > > http://www.citi.umich.edu/u/provos/ssh/privsep.html
> >
> > os.system("su -m <unprivileged_user> -c '<command string>'")
> >
> > seems to do the trick.
> 
> Yes, because ‘os.system’ explicitly starts a new process.
> 
> It can't be done in the same process, as Heiko correctly said.
> 
> -- 
>  \       “Faith, n. Belief without evidence in what is told by one who |
>   `\   speaks without knowledge, of things without parallel.” —Ambrose |
> _o__)                           Bierce, _The Devil's Dictionary_, 1906 |
> Ben Finney

I didn't ask how to do it in the same process, but thanks to both of you for that information.

By the way, are you guys aware of seteuid and setegid?

Back to comp.lang.python | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Inconsistency between os.getgroups and os.system('groups') after os.setgroups() jeff <3beezer@gmail.com> - 2012-03-25 14:32 -0700
  Re: Inconsistency between os.getgroups and os.system('groups') after os.setgroups() Heiko Wundram <modelnine@modelnine.org> - 2012-03-26 00:04 +0200
    Re: Inconsistency between os.getgroups and os.system('groups') after os.setgroups() jeff <3beezer@gmail.com> - 2012-03-25 16:33 -0700
    Re: Inconsistency between os.getgroups and os.system('groups') after os.setgroups() jeff <3beezer@gmail.com> - 2012-03-25 16:33 -0700
      Re: Inconsistency between os.getgroups and os.system('groups') after os.setgroups() Ben Finney <ben+python@benfinney.id.au> - 2012-03-26 11:22 +1100
        Re: Inconsistency between os.getgroups and os.system('groups') after os.setgroups() jeff <3beezer@gmail.com> - 2012-03-26 07:41 -0700

csiph-web