Consider this python script, which invokes HandBrakeCLI, a program that attempts to read from the dvd drive:
#!/usr/bin/python import sys import os import subprocess as subp import pprint #immediately switch users os.setgid(1002) #gid of "media" os.setuid(1005) #uid of "jack" #verify the switch worked print os.getuid(), os.geteuid() print os.getgid(), os.getegid() #clear up any possible env var diffs os.environ['USER'] = 'jack' os.environ['USERNAME'] = 'jack' os.environ['LOGNAME'] = 'jack' #output env variables to see if there's anything different: ff = open('env_%s.log' % sys.argv, 'w') ff.write(pprint.pformat(dict(os.environ))) ff.write("\n") ff.close() #call the program p = subp.Popen(["HandBrakeCLI", "-i", "/dev/sr0", "-t", "0"]) p.communicate() sys.exit(p.returncode)
The following ("A") succeeds:
sudo -u jack -g media HandBrakeCLI -i /dev/sr0 -t 0
as does this ("B"):
sudo -u jack -g media ./invoke.py jack
but this ("C") fails:
sudo ./invoke.py root
and prints errors suggesting that HandBrakeCLI was unable to access the CD drive. The print statements confirm that the UID/GID were successfully changed to jack:media, however. If I remove the setuid/setgid and call HandBrakeCLI from invoke.py as root, it works once again.
A diff shows the environments are essentially the same:
$ diff env_root.log env_jack.log 8c8 < 'SUDO_COMMAND': './invoke.py root', --- > 'SUDO_COMMAND': './invoke.py jack',
After invoking setuid and setgid, is there any "memory" of the original invoking user? If not, what could HandBrake possibly be seeing differently between "B" and "C"?
I am running 10.04 on a headless server which I access via ssh.