Re: [Caml-list] on ocaml and set-user-id programs

[Kim Nguyen <Kim.Nguyen@lri.fr>]

Le dimanche 27 mars 2005 à 12:01 +0200, Stefano Zacchiroli a écrit :
> I've wrote an ocaml program that needs to be executed set-user-id root.
> 
> I managed to have it being executed with effective user id 0 only
> compiling in native code or in custom bytecode. Both executing it as a
> script using "ocamlrun ocaml" and compiling it to non-custom bytecode
> make the program having effective user id of the user executing it.

Yes. The linux kernel (and maybe other unices but i'm not sure) disable
the setuid bit for shell scripts since it's really unsecure. Perl
circumvents this by having a setuid binary wrapper that does some extra
security check and launch the scripts (which inherits the privileges of
the setuid wrapper). See perlsec documentation for more details.
(This explain why the custom byte code works, since it's a binary that
embeds both the script and the interpreter).

> This behaviour is annoying and makes impossible to run ocaml set-user-id
> programs where the native code compiler isn't available. 

Indeed. Maybe the ocaml distribution could provide such a wrapper.

Hope this helps,
-- 
Kim