switch back and forth from root to a user

[djurdjura]

Hi there,

I looked around and couldn't find an answer to this question (and I'm now wondering is there is one :-)

I have a piece of code in which I need to switch from root to a particular user, run the command as this user and would like to return to root. I don't want to use, if possible at all, "su".

Here is the snippet code that is run as root initially:

import os
try:
  if os.name == 'posix':
    import pwd
    pw  = pwd.getpwnam(user)
    uid = pw.pw_uid
    os.setuid(uid)
except:
    return 1 # Error
finally:
  # Put back root user...
  os.setuid(0)

As you can imagine, you can't set back to root (setuid(0)) - running as 'user' at this point.

Thanks in advance for any help.

D.

[djurdjura]

Oops! Correcting indentation:

import os
try:
  if os.name == 'posix':
    import pwd
 
    pw = pwd.getpwnam(user)
    uid = pw.pw_uid
    os.setuid(uid)
else:
    # Do something useful here
except:
  return 1 # Error
finally:
  # Put back root user...
  os.setuid(0)
 

[dwblas]

Hopefully, no OS will let you do that. su and sudo are there to limit escalation of privileges, and are the only way that you can do this AFAIK.

[djurdjura]

May be I wasn't clear enough. The script runs as root all the time. I just need to run the few steps as a given user and get back to root. Theses steps involve populating a cron tab. I'm looking for the best way of doing that. An idea that I was thinking of was to do this in a separate thread, then this approach isn't Posix compliant and I'm not sure if the whole process doesn't get the same UID (the script runs under Solaris).

Any other ideas?

[dwblas]

Theses steps involve populating a cron tab

It is as simple as changing the permissions of cron to the user's (it never is). I tried multiprocessing (on Linux) and it appears to work. I am not a fan of setuid so know very little about it.

import os
import pwd
import time
from multiprocessing import Process
 
class TestClass():
 
    def test_f(self, user):
       try:
           if os.name == 'posix':
 
               pw = pwd.getpwnam(user)
               uid = pw.pw_uid
               os.setuid(uid)
               print "setuid successful", pw
 
               ##--- create file as test of permissions
               fp = open("./test_user", "w")
               fp.write("test user\n")
               fp.close()
       except:
           return 1 # Error
 
if __name__ == '__main__':
    CT=TestClass()
    p = Process(target=CT.test_f, args=('user name',))
    p.start()
 
    ## sleep for 5 seconds to simulate processing and terminate
    time.sleep(5.0)
    p.terminate()
 
    ##--- create file as test of permissions
    fp = open("./test_root", "w")
    fp.write("test root\n")
    fp.close()