Drop Process Privileges

Question

I have a process that gets started by a damon running as root, now I want to "downgrade" this process's privileges to those of your average user. Is this possible? If yes how?

PS: Running unix on a mac

Answer 1

The process itself has to call setuid(2). You should also investigate running it inside chroot(8) if you arent already. As far as I know there is no way for root to change the uid of another process.

If the reason you are running it as root is to bind ports I'd suggest running it as a normal user on a higher port and using ipfw(8) on OS X to forward port 80/443/etc to the higher port:

http://support.crashplanpro.com/doku.php/recipe/forward_port_443_to_pro_server_on_mac_osx

Answer 2

sudo tcpdump -Z uses initgroups(3), setgid(2) and setuid(2) to drop the root privileges of its own process.

# code taken from: 
# http://www.opensource.apple.com/source/tcpdump/tcpdump-32/tcpdump/tcpdump.c

/* Drop root privileges and chroot if necessary */
static void
droproot(const char *username, const char *chroot_dir)
{
...
            if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
               setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) {
                    fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n",
                        username, 
                        (unsigned long)pw->pw_uid,
                        (unsigned long)pw->pw_gid,
                        pcap_strerror(errno));
                    exit(1);
            }
...
}

Answer 3

You can run commands as other users using su:

 su USERNAME -c COMMAND

Will run COMMAND with privileges dropped to USER.

---

Note that, by default, su will use the target user's shell interpreter to run the command. By contrast, the default behaviour of sudo is to treat the COMMAND as a standalone program, that is run the current environment. Of course these default behaviours can be changed with various switches and environment variables.

Answer 4

To drop privileges, you need a non-root user to drop to. Then it's just a matter of switching to that user:

#define UNPRIV_UID  48
#define UNPRIV_GID  48

if (getuid() == 0) { // we are root
    // setting UID/GID requires root privileges, so if you don't set
    // the GID first, you won't be able to do it at all.
    if (setgid(UNPRIV_GID)!=0) die("Failed to set nonroot GID");
    if (setuid(UNPRIV_UID)!=0) die("Failed to set nonroot UID");
}

ASSERT(getuid() != 0); 

Note that this is done within the program itself, rather than in a wrapper script. Many programs require root privileges for some specific purpose (e.g. to bind to a low-numbered port), but don't need root after that. So these programs will start as root, but then drop privileges once they're no longer needed.

If you don't need root privileges at all, then just don't run it as root. E.g.:

# Change this:
myprog -C /my/config/file

# To this:
sudo -u someuser myprog -C /my/config/file
# Or this
su someuser -c "myprog -C /my/config/file"

Answer 5

If you're executing a different executable, i.e. you're calling execve or another of the exec familiy of function, perhaps indirectly through a function like system or popen, and the child process should run without privileges from the start, then the simplest way is to get a shell involved, and call su. Here's an overview of how the code might look like in Perl, showing the quoting needed for :

$shell_command = quotemeta($path_to_executable) . " --option";
$shell_command =~ s/'/'\\''/; # protect single quotes for the use as argument to su
$su_command = sprintf("su -c '%s' %s", $shell_command, quotemeta($user_name));
open(PIPE, "$su_command |") or die;

If the child process needs to start as root but drop privileges later, see the code in this answer, which illustrates how to downgrade privileges in a process.