Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have started some processes (window based) from user's .bashrc file. I want to prevent users from killing those processes. Is there a way to transfer the process to superuser so that a normal user cannot kill it? Or is there a way of starting some process which is owned by super user himself?

share|improve this question
2  
You already provided an answer with your sudo tag. –  Marco Sep 4 '12 at 18:14
    
Yeah why not just run it as root sudo /path/to/executable or do sudo su and then `/path/to/executable'? –  mtahmed Sep 4 '12 at 18:55
    
super user won't be logged into the system. Its just a PC and not a computer where multiple users can login. –  Juzer Ali Sep 4 '12 at 18:57
1  
Could you please explain what you're trying to accomplish? There may be a much easier way. –  derobert Sep 4 '12 at 19:36
    
A highly controlled environment where user has just one window open. I am using Ubuntu 12.04 and already have disabled many other things. This isn't show stopper. But I was just wondering. –  Juzer Ali Sep 5 '12 at 3:51

3 Answers 3

You may built in a trap in your processes to prevent a normal kill (SIGINT). That would of course not work for a SIGKILL (-9). Such a trap would look like (bash):

trap "echo trapped" INT

To reset the trap you could use

trap - INT
share|improve this answer

Start a command as a different user is usually done with su, sudo or by setting the setuid bit in the permissions of the executable.

You do not want to have executables run as root unless they absolutely need to, as that user has all priviledges. If those processes don't need any priviledge, you can make them run as "nobody" which is the user whom we try to grant the least prviledges as possible.

A user has always the right to kill its own processes (as long as it's got access to the kill system call), or said otherwise, a process of a given effective uid has always the right to send a signal to a process running as the same effective uid.

share|improve this answer

Depends on what exactly you're doing, but your options are:

  • Make the user able to run the program as a different user. You can do this via sudo, or via the setuid on the executable. Beware that with either of these, things other than the user's .bashrc will be able to start the program. (Note: both sudo and setuid can be users other than root, and should be if possible)
  • Have the login system invoke the process (as root) before actually finishing the user login. The advantage here is that you're not granting any permissions to the user, and the user won't be able to get around it (via, e.g., editing or removing .bashrc, or switching shells, or...). One way appears to be pam_exec to hook into PAM. Your executable should drop root privileges if possible.
share|improve this answer
    
Can you elaborate more about the second process. That sounds about what I need. I am a noob here, sorry for the inconvenience. Also remember 1)I don't want to grant any extra permissions to user, definitely not su. 2) It is a window based program, will initializing it before finishing the user login have other dependencies (like window management system) already initialized? –  Juzer Ali Sep 4 '12 at 19:30
    
@juzerali oh, it runs under X? That's going to be much harder... –  derobert Sep 4 '12 at 19:33
    
@juzerali in fact, I think xkill may destroy the X connection of even a root-owned process. Would have to test that. –  derobert Sep 4 '12 at 19:35
    
:O, never thought about that. –  Juzer Ali Sep 4 '12 at 19:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.