From owner-freebsd-questions  Fri Oct 26 14: 4:28 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from shumai.marcuscom.com (rdu57-28-046.nc.rr.com [66.57.28.46])
	by hub.freebsd.org (Postfix) with ESMTP id DEAAA37B405
	for <freebsd-questions@FreeBSD.ORG>; Fri, 26 Oct 2001 14:04:22 -0700 (PDT)
Received: from localhost (marcus@localhost)
	by shumai.marcuscom.com (8.11.6/8.11.6) with ESMTP id f9QL4HL00853;
	Fri, 26 Oct 2001 17:04:17 -0400 (EDT)
	(envelope-from marcus@marcuscom.com)
X-Authentication-Warning: shumai.marcuscom.com: marcus owned process doing -bs
Date: Fri, 26 Oct 2001 17:04:17 -0400 (EDT)
From: Joe Clarke <marcus@marcuscom.com>
To: Michael Grant <mg-fbsd2@grant.org>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: running a program as nobody
In-Reply-To: <200110262059.VAA21039@splat.grant.org>
Message-ID: <20011026170138.Q731-100000@shumai.marcuscom.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG



On Fri, 26 Oct 2001, Michael Grant wrote:

> I want to run a particular daemon as userid nobody.  I tried the
> obvious thing of using su like this:
>
> su -c nobody nobody /usr/local/bin/food

This won't work since nobody doesn't have a valid shell.  You could write
a small C wrapper for "food" that could run the program as nobody:

#define REAL_PATH "/usr/local/bin/food"
#define NOBODY 65534

main(ac, av) {
	char **av;
{
	setuid(NOBODY);
	execv(REAL_PATH, av);
}

Of course, it's not a good idea to run programs as nobody since that is a
"special" user.  It's best to create another sandbox user specifically for
use with your program, then run your program as that user.

Joe

>
> but no matter what I try, I cannot get something like this to work.
>
> Is there some standard way to do this other than writing a C program
> wrapper myself?  I see something called "jail" but that seems a bit
> heafty, it looks like I would have to install a complete version of
> freebsd in some directory practically creating a virtual machine.
>
> Surely there must be some simple way to do run a program as nobody,
> maybe chrooted as well?
>
>
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of the message
>
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message