{"id":43,"date":"2008-01-31T03:08:47","date_gmt":"2008-01-31T00:08:47","guid":{"rendered":"http:\/\/www.held.org.il\/blog\/?p=43"},"modified":"2008-01-31T03:08:47","modified_gmt":"2008-01-31T00:08:47","slug":"switch-to-another-uidgid-in-a-perl","status":"publish","type":"post","link":"http:\/\/www.held.org.il\/blog\/2008\/01\/switch-to-another-uidgid-in-a-perl\/","title":{"rendered":"Switch to another UID\/GID, with Perl"},"content":{"rendered":"

Originally I wanted to start by describing Linux' setuid()-like functions, which change the user-id of a running process (and more). Some reading<\/a> made me realize that this area is too big (but interesting!) for a simple post, and also that I still don't master it..<\/p>\n

So I'll focus only a single, simple task: switching from root to regular user<\/strong> permissions:<\/strong> when a daemon is being run by root<\/strong> (i.e. init scripts), for security reasons we want them to \"transform\" to a regular user right asap. In the kernel level we want to do something like setuid<\/em> or setresuid<\/em> (set all the user identifiers: Real, Effective and Saved) to a specific, different UID.<\/p>\n

However, we don't talk about the kernel, but about a much higher scripting language.. So let's begin with basics: according to perlvar<\/em> manpage<\/a>, $><\/em> (or $EUID<\/em> if using 'use English'<\/em>) represents the Effective<\/strong> User ID (Effective is the User ID which matters permission-wise). \"print $>\"<\/em> perl command would simply print the EUID.<\/p>\n

Now for the surprise.. \"$>=44<\/em>\" perl command simply sets<\/strong> the EUID! Oh, the simplicity \ud83d\ude42<\/p>\n

GID can be set in a similar manner, but can't be set after<\/strong> the the uid is switched (we need the initial root permission for the GID switch).<\/p>\n

Enough talking, let the code begin:
\n
\n#!\/usr\/bin\/perl -w
\nuse strict;
\nues English;
\n$EGID=22;
\n$EUID=22;
\nsleep 50; # Sleep so we can have time to run \"ps axo pid,uid,euid,gid,egid\" :)
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

Originally I wanted to start by describing Linux’ setuid()-like functions, which change the user-id of a running process (and more). Some reading made me realize that this area is too big (but interesting!) for a simple post, and also that I still don’t master it.. So I’ll focus only a single, simple task: switching from […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[75,11],"tags":[203,86,121],"_links":{"self":[{"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/posts\/43"}],"collection":[{"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/comments?post=43"}],"version-history":[{"count":0,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/posts\/43\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/media?parent=43"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/categories?post=43"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/tags?post=43"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}