Re: Getting a process to run as root

[Wayne Marshall <wcm@b0llix.net>]

On Wed, 25 Apr 2012 11:20:41 +0100
Peter Hickman <peterhickman386@googlemail.com> wrote:

> I have an application that scans log files that is written in
> Ruby. It is installed as the user log_watcher but needs to be
> run as root so that it can have the rights to read the various
> log files that it needs. Essentially the
> service/log_watcher/run file comes down to "sudo ruby
> log_watcher.rb", the log_watcher user has passwordless sudo
> rights.
> 
> We have runit / supervise installed but when we try and start
> the application it complains about supervise/ok or
> supervise/lock being unavailable which means that the process
> is not being restarted after a reboot.
> 
> How do I get to run the process as root from the log_watcher
> user. I've tried various things I've seen in the wiki and got
> back from googling but nothing seems to work. Or perhaps there
> is another way around this?
> 

Normally a supervision environment runs with root permission by
default.  This means that all your supervised services will
*start out* with root privilege.

Many supervision packages include utilities that may be used to
shape the permissions of service processes.  In practice, these
utilities are used as a means to *drop* privilege, so that
your service will then run without root permission.

The point here is that your scenario is rather uncommon, because
evidently you are using sudo in a runscript to *escalate*
privilege.  That is usually not done.

My suggestion is that you try to think through your service
again, to clarify what you are trying to accomplish.

Based on the information you have provided, it would seem
feasible to run the "log_watcher" service without root
privilege, as long as you can assign it all the group read
permissions it needs in order to access the various log files it
is scanning.

See for example the runuid(8) utility in the latest perp
distribution:

http://b0llix.net/perp/site.cgi?page=runuid.8

The -S option for this utility allows you to run a process as an
unprivileged user, and with any number of supplementary group
permissions.

Best regards,

Wayne