Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite

I am looking for something like sudo (or something that can be run from sudo) that allows me to run a program with my uid and primary gid, but with an additional supplementary group.

share|improve this question
2  
To accomplish what? – jordanm Dec 5 '12 at 0:49
I have a couple of programs that I would like to run as my user, but which require more privileges than I want to grant to my user as a whole. For example, VirtualBox needs direct access to my hard drive to boot my Windows partition, but I definitely don't want any random program to be able to scribble all over my hard drive. My first approach was to create a separate user for running VirtualBox, but that created many difficulties that would be avoided through this approach. – rkjnsn Dec 5 '12 at 19:56
just add your user to the vboxusers group. – jordanm Dec 5 '12 at 20:36
@jordanm The vboxusers membership merely allows me to run VirtualBox. Is has nothing to do with allowing VirtualBox to have raw access to my hard drive without allowing the same to other applications. – rkjnsn Dec 5 '12 at 21:53

2 Answers

up vote 1 down vote accepted

Warning #1: this is an alternative 'hacky' approach.

Warning #2: not all applications/script might be able to handle this ambiguous uid/gid.

Create a new user with the same uid and gid, by using useradd, its --non-unique option to allow that multiple users with the same uid/gid exist and its --groups option to specify additional groups. E.g.:

useradd --uid 1001 --gid 1001 --groups 1002,1003 --shell /bin/bash \
        --home /home/cloneduser cloneduser

You should then run the program as this new user. I suggest to debug it using id.

share|improve this answer
+1 for an interesting solution of which I hadn't thought. It does feel a bit hacky/possibly problematic, but I'll definitely give it a try if I don't find a cleaner solution. – rkjnsn Dec 5 '12 at 22:32
I've been using this solution for a bit, and it seems to work quite well. sudo -E -u cloneduser allows me to easily run a program with the alternative group list. One difference is that I used the same home directory for my cloned user instead of adding another one. – rkjnsn Jan 10 at 22:31
up vote 0 down vote

It is not clear if you want that the additional group become as if it would be the primary group, i.e., the group of all new files created; or if this group is not even a seconday group of that user.

In first case, if you are already a member of that group, you may use two different commands "newgrp" and "sg". Both accomplish the same result, but one execute an interactive shell with the new gid, while the second one only execute a command.

In the second case, you should setup a password for the group using command groupadd or groupmod, then, again, when using "newgrp" or "sg" you will be prompted for that password before executing the command.

Another different, and simpler, approach, is to change the group owner of your executable, ad set its setgid bit. More information about this bit is on the man page for chmod.

share|improve this answer
"It is not clear..." I think it is - from the Q: "additional supplementary group". newgrp will change the primary gid. Passwords on groups are quite obscure imo. A setgid is a nice suggestion, yet that also changes the primary group for that process. – gertvdijk Dec 5 '12 at 10:40
if he want to keep his uid and gid, and he doesn't want to have that group as supplemental, then he is forced to use password in order to "enter" the group, but then, as you say, that group would become his primary group (temporary). – eppesuig Dec 5 '12 at 11:21
The group should not become the primary group for the process, and it is a group of which my user is not a member. – rkjnsn Dec 5 '12 at 20:00
In this case, I think you cannot do it. The reason is that whenever you add a user to a group, then this new membership will be activated only at login or su. As an example, if you open a shell with your normal user, run command "groups", then add that user to a new group, check again with "groups", you will not see the new membership. It is available as shown by other commands, like "id", but it does not apply to running processes. So the only possible solution is to use newgrp/sg but you are changing the effective group id of the process. – eppesuig Dec 6 '12 at 9:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.