[9fans] as.c -- invoke things as another user.

[9fans] as.c -- invoke things as another user.

[Dan Cross]

[-- Attachment #1: Type: text/plain, Size: 1562 bytes --]

So I wanted to run a factotum from the console as none, so that I could
load it up with a key to use with the TLS support in ip/httpd/httpd.
Unfortunately (maybe because it was late, I was tired, and had had a
bit of rum earlier in the evening), I couldn't figure out a way from
within rc to write to #c/user and then exec another program.  I could
write to '#c/user' easily enough, I could run other programs, but I
couldn't get the combination to work.  So, I wrote a simple C program
to do it for me.  (btw- if anyone has an rc recipe for this, let me
know).

I've attached that program here.  I installed it as auth/as, and one
uses it by running, e.g., ``auth/as user 'quoted cmd to pass rc' ''.
I'm now using it to start my httpd server out of cpurc as follows:

	auth/secstore -nG httpd.none | as none /usr/webs/bin/rc/start

Where httpd.none contains the key to use with my httpd cert, and
start looks something like the following:

#!/bin/rc
auth/factotum -s factotum.https
sleep 1	# let factotum start
read -m > /mnt/factotum/ctl
ip/httpd/httpd -n /lib/namespace.https -c /sys/lib/tls/httpd-cert.pem

(/lib/namespace.https has ``mount -b /srv/factotum.https /mnt'' in it
to make sure that the factotum started as none is in the web server's
name space!).

This works pretty well, but the real value of as is for invoking
commands as another user (provided your authenticated to do so, of
course) from shell scripts and the like.  If anyone knows of a
better approach, I'd love to hear about it.  Thanks!

	- Dan C.


[-- Attachment #2: Type: text/plain, Size: 469 bytes --]

#include <u.h>
#include <libc.h>

void
main(int argc, char *argv[])
{
	int	fd;

	if (argc != 3) {
		fprint(2, "Usage: as user command\n");
		exits(0);
	}
	fd = open("#c/user", OWRITE);
	if (fd < 0)
		sysfatal("can't open #c/user: %r\n");
	if (write(fd, argv[1], strlen(argv[1])) != strlen(argv[1]))
		sysfatal("couldn't set user to %s: %r\n", argv[1]);
	close(fd);
	execl("/bin/rc", "rc", "-c", argv[2], nil);
	sysfatal("couldn't run rc: %r\n");
}

Re: [9fans] as.c -- invoke things as another user.

[Russ Cox]

The only user name you can write to #c is none, so
a few of us use a short C program called none:

#include <u.h>
#include <libc.h>
#include <auth.h>

void
main(int argc, char *argv[])
{
	char cmd[8192];
	int fd;

	argv0 = argv[0];
	if (rfork(RFENVG|RFNAMEG) < 0)
		sysfatal("can't make new pgrp");

	fd = open("#c/user", OWRITE);
	if (fd < 0)
		sysfatal("can't open #c/user");
	if (write(fd, "none", strlen("none")) < 0)
		sysfatal("can't become none");
	close(fd);

	if (newns("none", nil) < 0)
		sysfatal("can't build namespace");

	if (argc > 1) {
		strcpy(cmd, argv[1]);
		exec(cmd, &argv[1]);
		if (strncmp(cmd, "/", 1) != 0
		&& strncmp(cmd, "./", 2) != 0
		&& strncmp(cmd, "../", 3) != 0) {
			sprint(cmd, "/bin/%s", argv[1]);
			exec(cmd, &argv[1]);
		}
	} else {
		strcpy(cmd, "/bin/rc");
		execl(cmd, cmd, nil);
	}
	sysfatal(cmd);
}

Re: [9fans] as.c -- invoke things as another user.

[Dan Cross]

> The only user name you can write to #c is none,

Oh for real?  You learn something new every day....

> so a few of us use a short C program called none:

Cool!  Could this go in the distribution?

	- Dan C.

Re: [9fans] as.c -- invoke things as another user.

[Russ Cox]

> > The only user name you can write to #c is none,
> 
> Oh for real?  You learn something new every day....

#c/user commanded more respect before
#¤ and factotum stole its glory.

Re: [9fans] as.c -- invoke things as another user.

[Dan Cross]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 189 bytes --]

> > Oh for real?  You learn something new every day....
> 
> #c/user commanded more respect before
> #¤ and factotum stole its glory.

Sounds like Mike D and MCA A.

	- Dan C.