Date: Fri, 26 Oct 2001 17:04:17 -0400 (EDT) From: Joe Clarke <marcus@marcuscom.com> To: Michael Grant <mg-fbsd2@grant.org> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: running a program as nobody Message-ID: <20011026170138.Q731-100000@shumai.marcuscom.com> In-Reply-To: <200110262059.VAA21039@splat.grant.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 26 Oct 2001, Michael Grant wrote:
> I want to run a particular daemon as userid nobody. I tried the
> obvious thing of using su like this:
>
> su -c nobody nobody /usr/local/bin/food
This won't work since nobody doesn't have a valid shell. You could write
a small C wrapper for "food" that could run the program as nobody:
#define REAL_PATH "/usr/local/bin/food"
#define NOBODY 65534
main(ac, av) {
char **av;
{
setuid(NOBODY);
execv(REAL_PATH, av);
}
Of course, it's not a good idea to run programs as nobody since that is a
"special" user. It's best to create another sandbox user specifically for
use with your program, then run your program as that user.
Joe
>
> but no matter what I try, I cannot get something like this to work.
>
> Is there some standard way to do this other than writing a C program
> wrapper myself? I see something called "jail" but that seems a bit
> heafty, it looks like I would have to install a complete version of
> freebsd in some directory practically creating a virtual machine.
>
> Surely there must be some simple way to do run a program as nobody,
> maybe chrooted as well?
>
>
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of the message
>
>
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011026170138.Q731-100000>