remote server and effective uid

[Tim Arnold]

Hi,
I have a remote server on a FreeBSD box with clients connecting from
linux, all running python2.7. I've setup the remote server as an inetd
service (currently running as 'nobody'). Both client and server have
access to the same file systems.

How can I enable the server process to write into the client's
directories?
If I change the inetd service to run as 'root', I guess that would
work, but then the client couldn't remove the files put there after
the request.
I could ditch the whole server process and wrap client requests with
rsh calls, but is there a way I can switch the effective uid of the
server process without asking clients to login?

Or is there a better way to solve the problem?

thanks,
--Tim Arnold

 

[Tim Harig]

How can I enable the server process to write into the client's
directories?
If I change the inetd service to run as 'root', I guess that would
work, but then the client couldn't remove the files put there after
the request.

Python provides os.setuid() and os.seteuid() which wrap the system
functions. See you systems man pages for these functions for more
information.

 

[Tim Arnold]

Python provides os.setuid() and os.seteuid() which wrap the system
functions.  See you systems man pages for these functions for more
information.

Thanks -- that was a lot easier than I thought it was going to be.
pass the client's uid in the message to the server like so

argstring, local_dir, uid = message.split(':')
os.seteuid(int(uid))

thanks again,
--Tim

 

[Tim Harig]

Thanks -- that was a lot easier than I thought it was going to be.
pass the client's uid in the message to the server like so

argstring, local_dir, uid = message.split(':')
os.seteuid(int(uid))

I am not sure exactly what you are doing; but, I would advise great
caution as messing this up could easily open your system to exploitation.
Be very sure that you know what you are doing.

 

[Tim Arnold]

I am not sure exactly what you are doing; but, I would advise great
caution as messing this up could easily open your system to exploitation.
Be very sure that you know what you are doing.

I can see how that looks dangerous, but I think it's okay. I have inetd
listening on a port and whatever it receives, it passes on to that line
above "argstring, local_dir, uid message.split(':'). The argstring is
parsed using 'argparse' the resulting list of args is passed to a Python
class that can only do work for a specific set of args. I can't think of a
way someone could pass in an evil argstring that could do anything but fail.

Thanks for your reply, and if you still think it's dangerous please let me
know.
--Tim