Connecting Tech Pros Worldwide Help | Site Map

sending signals to processes as a different user than owner using php

rs035
Guest
 
Posts: n/a
#1: Jul 17 '05
good morning, everybody
i know, it seems more to be a problem according to unix but i got it while
developing software with php:
i have 2 different users on a hp-ux machine that execute php scripts. they
are both in the same group.
these php scripts start background processes, i can communicate with using
signals (sending with posix_kill, starting background processes via
pcntl_fork).
so i got severel background processes owned by my 2 users.
the problem is i want to send signals as one of my 2 users to all my php
background processes no matter who of my 2 users is the owner. is it
possible other than using external tools like sudo?
i'm using:
PHP 4.3.4 (cgi) (built: Aug 18 2004 15:37:46)
Copyright (c) 1997-2003 The PHP Group
Zend Engine v1.3.0, Copyright (c) 1998-2003 Zend Technologies

compiled with:
../configure' '--prefix=/usr/local/php-cgi-saprfc' '--enable-calendar'
'--enable-filepro' '--with-gd' '--with-jpeg-dir=/usr/local'
'--with-zlib-dir=/usr/local' '--without-mysql' '--enable-sysvsem'
'--enable-sysvshm' '--with-pgsql=/usr/local/pgsql' '--enable-trans-sid'
'--with-cpdflib=/usr/local' '--enable-sockets' '--with-ncurses=/usr/local'
'--disable-shared' '--with-tsrm-pthreads' '--with-saprfc=/usr/local/rfcsdk'
'--enable-pcntl

thanks
rolf


Colin McKinnon
Guest
 
Posts: n/a
#2: Jul 17 '05

re: sending signals to processes as a different user than owner using php


rs035 wrote:
[color=blue]
> i have 2 different users on a hp-ux machine that execute php scripts. they
> are both in the same group.
> these php scripts start background processes, i can communicate with using
> signals (sending with posix_kill, starting background processes via
> pcntl_fork).
> so i got severel background processes owned by my 2 users.
> the problem is i want to send signals as one of my 2 users to all my php
> background processes no matter who of my 2 users is the owner. is it
> possible other than using external tools like sudo?[/color]

Sort of, but you really should understand the security model of Unix before
you start stretching the rules.

The only obvious solution I see within the constraints you've specified
would be to put the two users into their own group, then setup a program to
run setuid as the other user but only executable by the isolated group.
e.g.:
-rwsr-xr-- userA php_script_group signal_as_userA
-rwsr-xr-- userB php_script_group signal_as_userB

HTH

C.
Closed Thread