Inconsistency between os.getgroups and os.system('groups') after os.setgroups()

[jeff]

Run this test program as root:

import os

print "before:", os.getgroups()
os.system("groups")
os.setgroups([])
print "after:", os.getgroups()
os.system("groups")

After the os.setgroups, os.getgroups says that the process is not in any groups, just as you would expect. However the groups command run using os.system says that the process is in the root group. It appears that the new process started by os.system augments the group membership specified in the os.setgroups command with the group of the actual user of the original process (which is root). I can suppress membership in the root group only by doing os.setgid and os.setuid before the os.system call (in which case I wind up in the group of the new user instead of root), but I have to be able to get back to root privilege so I can't use setgid and setuid. How do I run a program from a Python script running as root such that the group membership of the process running the program does not include root?

 

[Heiko Wundram]

Am 25.03.2012 23:32, schrieb jeff:

After the os.setgroups, os.getgroups says that the process is not in
any groups, just as you would expect... I can suppress
membership in the root group only by doing os.setgid and os.setuid
before the os.system call (in which case I wind up in the group of
the
new user instead of root), but I have to be able to get back to root
privilege so I can't use setgid and setuid.

Simply not possible (i.e., you can't drop root privileges, be it by
setuid()/setgid() or removing yourself from groups with setgroups()),
and later reacquire them _in the same process_. See the discussion of
how to implement privilege separation at

http://www.citi.umich.edu/u/provos/ssh/privsep.html

(which discusses how this is implemented in OpenSSH) by running
multiple processes which communicate through IPC mechanisms, and each of
those drops the rights it requires. Using IPC to implement
reduced-privilege process spawning has a long history; also, Postfix
comes to mind as an "early" adopter of a privilege separation mechanism.

 

[jeff]

Am 25.03.2012 23:32, schrieb jeff:

Simply not possible (i.e., you can't drop root privileges, be it by
setuid()/setgid() or removing yourself from groups with setgroups()),
and later reacquire them _in the same process_. See the discussion of
how to implement privilege separation at

http://www.citi.umich.edu/u/provos/ssh/privsep.html

(which discusses how this is implemented in OpenSSH) by running
multiple processes which communicate through IPC mechanisms, and each of
those drops the rights it requires. Using IPC to implement
reduced-privilege process spawning has a long history; also, Postfix
comes to mind as an "early" adopter of a privilege separation mechanism.

os.system("su -m <unprivileged_user> -c '<command string>'")

seems to do the trick.

 

[jeff]

Am 25.03.2012 23:32, schrieb jeff:

Simply not possible (i.e., you can't drop root privileges, be it by
setuid()/setgid() or removing yourself from groups with setgroups()),
and later reacquire them _in the same process_. See the discussion of
how to implement privilege separation at

http://www.citi.umich.edu/u/provos/ssh/privsep.html

(which discusses how this is implemented in OpenSSH) by running
multiple processes which communicate through IPC mechanisms, and each of
those drops the rights it requires. Using IPC to implement
reduced-privilege process spawning has a long history; also, Postfix
comes to mind as an "early" adopter of a privilege separation mechanism.

os.system("su -m <unprivileged_user> -c '<command string>'")

seems to do the trick.

 

[jeff]

Yes, because ‘os.system’ explicitly starts a new process.

It can't be done in the same process, as Heiko correctly said.

--
\ “Faith, n. Belief without evidence in what is told by one who |
`\ speaks without knowledge, of things without parallel.” —Ambrose |
_o__) Bierce, _The Devil's Dictionary_, 1906 |
Ben Finney

I didn't ask how to do it in the same process, but thanks to both of you for that information.

By the way, are you guys aware of seteuid and setegid?