04-05-2011
Quote:
Originally Posted by
disaster
My intention is to make one program available only over one call within another program.
Ah, sounds like what you're best off doing is creating a new group (e.g. 'proggrp') and making the calling program be owned by proggrp and setgid, and then making the called program owned by proggrp with the executable bit set only for the group. That way the user won't be able to chmod it (unless they own it - best make it owned by root, or use this scheme with a special user and setuid instead) and there will be no "gap" during which they can exploit the program's "executableness".
Edit: Also, by doing it this way you give control over who can run what to the system administrator (where it should be) as opposed to the programmer (who might not anticipate a need for more flexibility somewhere down the line...).
10 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
how to find the chid process id from given parent process id.... (the chid process doesnot have sub processes inturn) (3 Replies)
Discussion started by: guhas
3 Replies
2. Programming
Hello, I'm trying to implement a version of a bucketSort (kinda) server/client, but I'm having a VERY hard time on making the server behave correctly, when talking to the children, after it forks.
The server is kinda big (300+ lines), so I won't post it here, but here's what I'm doing.
1)create a... (8 Replies)
Discussion started by: Zarnick
8 Replies
3. UNIX for Advanced & Expert Users
Hi, as I understand fork(), it makes a copy of the parent which becomes a child. But is there anyway to make three children for that one parent. So in other words, if I look up the getppid() of the children, I want them to have the same value??
Thanks in advance to any help! (1 Reply)
Discussion started by: MS_CC
1 Replies
4. Shell Programming and Scripting
Hi All,
I have two ksh script. 1st script calls the 2nd script and the second script calls an 'C' program.
I want 1st script to wait until the 'C' program completes.
I cant able to get the process id for the 'C' program (child process) to make the 1st script to wait for the second... (7 Replies)
Discussion started by: sennidurai
7 Replies
5. Shell Programming and Scripting
Hey all, I need to launch a script from within 2 other scripts that can run independently of the two parent scripts... Im having a hard time doing this, if anyone knows how please let me know.
More detail.
ScriptA (bash), ScriptB (ksh), ScriptC (bash)
ScriptA, launches ScriptB
ScirptB,... (7 Replies)
Discussion started by: trey85stang
7 Replies
6. Programming
Hi gurus can you explain following lines of code ?
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
int main(void)
{
pid_t pid;
int rv;
switch(pid = fork()) {
case -1:
... (7 Replies)
Discussion started by: wakatana
7 Replies
7. Programming
Hi friends,
I have a small question regarding unix system call fork, I hope you will solve my problem. Here is the small program
$ cat fork1.c
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
int main()
{
int pid;
int x = 0;
x = x + 1;
pid = fork();
if(pid < 0)
{... (2 Replies)
Discussion started by: gabam
2 Replies
8. Shell Programming and Scripting
Hi everyone
i am very new to linux , working on bash shell.
I am trying to solve the given problem
1. Create a process and then create children using fork
2. Check the Status of the application for successful running.
3. Kill all the process(threads) except parent and first child... (2 Replies)
Discussion started by: vizz_k
2 Replies
9. UNIX for Dummies Questions & Answers
Hi all,
Looking for some help, I have written a very simple script to pass to PowerHA to act as an indicator to activate failover required.
Where i get completely lost is I have to create a wait and carry out the grep for the process once every 10 seconds this works but need to embed this... (1 Reply)
Discussion started by: Gary Hay
1 Replies
10. UNIX for Beginners Questions & Answers
The task I have to do is something along the lines "I receive some input and based on the first character I send it through pipe to one of the children to print".
The scheme it is based on is 1->2; 1->3; 1->4; 2 will print all the input that starts with a letter, 3 will print all the input that... (2 Replies)
Discussion started by: Ildiko
2 Replies
LEARN ABOUT DEBIAN
gsexec
GSEXEC(8) GridSite Manual GSEXEC(8)
NAME
gsexec - Switch user before executing external programs
SYNOPSIS
gsexec [-V]
SUMMARY
gsexec is used by the Apache HTTP Server to switch to another user before executing CGI programs. In order to achieve this, it must run as
root. Since the HTTP daemon normally doesn't run as root, the gsexec executable needs the setuid bit set and must be owned by root. It
should never be writable for any other person than root.
gsexec is based on Apache's suexec, and its behaviour is controlled with the Apache configuration file directives GridSiteExecMethod and
GridSiteUserGroup added to Apache by mod_gridsite(8) Four execution methods are supported: nosetuid, suexec, X509DN and directory, and
these may be set on a per-directory basis within the Apache configuration file.
NOSETUID METHOD
This is the default behaviour, but can also be produced by giving GridSiteExecMethod nosetuid
CGI programs will then be executed without using gsexec, and will run as the Unix user given by the User and Group Apache directives (nor-
mally apache.apache on Red Hat derived systems.)
SUEXEC METHOD
If GridSiteExecMethod suexec is given for this virtual host or directory, then CGI programs will be executed using the user and group given
by the GridSiteUserGroup user group directive, which may also be set on a per-directory basis (unlike suexec's SuexecUserGroup which is
per-server only.) The CGI program must either be owned by root, the Apache user and group specified at gsexec build-time (normally
apache.apache) or by the user and group given with the GridSiteUserGroup directive.
X509DN METHOD
If GridSiteExecMethod X509DN is given, then the CGI program runs as a pool user, detemined using lock files in the exec mapping directory
chosen as build time of gsexec. The pool user is chosen according to the client's full certificate X.509 DN (ie with any trailing GSI
proxy name components stripped off.) Subsequent requests by the same X.509 identity will be mapped to the same pool user. The CGI program
must either be owned by root, the Apache user and group specified at gsexec build-time (normally apache.apache) or by the pool user
selected.
DIRECTORY METHOD
If GridSiteExecMethod directory is given, then the CGI program runs as a pool user chosen according to the directory in which the CGI is
located: all CGIs in that directory run as the same pool user. The CGI program must either be owned by root, the Apache user and group
specified at gsexec build-time (normally apache.apache) or by the pool user selected.
EXECMAPDIR
The default exec mapping directory is /var/www/execmapdir and this is fixed when the gsexec executable is built. The exec mapping directory
and all of its lock files must be owned and only writable by root. To initialise the lock files, create an empty lock file for each pool
user, with the pool username as the filename (eg user0001, user0002, ...) As the pool users are leased to X.509 identities or directories,
they will become hard linked to lock files with the URL-encoded X.509 DN or full directory path.
You can recycle pool users by removing the corresponding URL-encoded hard link. stat(1) and ls(1) with option -i can be used to print the
inodes of lock files to match up the hard links.
However, you must ensure that all files and processes owned by the pool user are deleted before recycling!
OPTIONS
-V If you are root, this option displays the compile options of gsexec. For security reasons all configuration options are changeable
only at compile time.
MORE INFORMATION
For further information about the concepts and the security model of the original Apache suexec please refer to the suexec documentation:
http://httpd.apache.org/docs-2.0/suexec.html
For examples using the gsexec extensions, please see the GridSite gsexec page:
http://www.gridsite.org/wiki/Gsexec
AUTHORS
Apache project, for original suexec
Andrew McNab <Andrew.McNab@manchester.ac.uk> for gsexec modifications.
gsexec is part of GridSite: http://www.gridsite.org/
SEE ALSO
httpd(8), suexec(8), mod_gridsite(8)
gsexec October 2005 GSEXEC(8)