10

I am editing a init.d script. The init.d script runs a utility script which then runs an process. From either bash scripts how would I make it launch the main process as a specific user and group?

12

The simplest way is to use the su(1) command, it has an option that allows you to run a command via the user's shell, example:

su foo -c ls

This will switch to the user foo and run the ls command. If the user you want to use does not have a valid shell (ie it's not in /etc/shells, like /bin/false or /sbin/nologin) you will also have to specify a shell on the command line. Example with output:

# su nobody -s /bin/bash -c id
uid=99(nobody) gid=99(nobody) groups=99(nobody) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
  • su seems to not like that i give it many arguments. I get Usage: su [options] [LOGIN] and su: unrecognized option '--debug' – user4069 Oct 5 '11 at 22:37
  • Its not exactly working. When i execute this line as root i get an error su www-data -c ${MONOSERVER} /applications=${WEBAPPS} /socket=unix:/path/monoserve.pid & if i su www-data set all the vars and run ${MONOSERVER} /applications=${WEBAPPS} /socket=unix:/path/monoserve.pid & it works fine. How so i solve this? – user4069 Oct 5 '11 at 22:58
  • 2
    @acidzombie24 su takes a single argument, which is a shell command. You need to write su www-data -c '$MONOSERVER "/application=$WEBAPPS" "/socket=unix:/path/monoserve.pid"', and make sure that MONOSERVER and WEBAPPS are exported by the parent shell. (Note: do not do su … -c "$MONOSERVER …" as this will fail if any of the variables contain shell special characters.) And if you have a dedicated daemon launcher such as start-stop-daemon, use it. – Gilles Oct 5 '11 at 23:36
  • Gilles: Alright, i am not replacing the init.d script with that am i? I can put all the variables into a new script and launch that as it be easy and i wouldnt have to learn anything. But whats so special about start-stop-daemon? I'll leave a comment on that answer – user4069 Oct 5 '11 at 23:45
  • Is it better to use su or su -login ? I read the man of su but I cannot understand for this specific case – Massimo Aug 8 '18 at 7:34
4

If start-stop-daemon is available on your system you should probably use it and have a look at its options (especially -u and -g in this case).

(Otherwise, you might use a combination of su and sg.)

Update: Here is an example taken from some /etc/init.d/mpd script (which uses start-stop-daemon):

  • Start command:

    echo "Starting Music Player Daemon"
    start-stop-daemon --start --quiet --background --exec /usr/bin/mpd \
        --pidfile /var/run/mpd.pid --make-pidfile \
        -- --no-daemon /etc/mpd.conf 2>/dev/null
    

    Everything that follows -- is an argument to the /usr/bin/mpd program itself. (The daemonization procedure is taken care of by the start-stop-daemon script so mpd is asked not to care about it with --nodaemon.)

  • Stop command:

    echo "Stopping Music Player Daemon"
    start-stop-daemon --stop --exec /usr/bin/mpd --pidfile /var/run/mpd.pid
    

If mpd was not dropping privileges by itself, one would need to add (for example) -u mpd, -g mpd options to the start-stop-daemon command.

  • I am not replacing the init.d script with start-stop-daemon am i? wouldnt it be easier to use su and a script file? If i replace init.d how do i install it to run at startup? what am i passing to start-stop-daemon? -edit- i am googling examples ATM maybe i wont need an answer but i feel like its going to be a complex answer – user4069 Oct 5 '11 at 23:47
  • 2
    No luck. Here is my line. It still runs as root. I checked the man pages and i still dont know what to do about this. start-stop-daemon --start --quiet --background -u www-data -g www-data --exec ${MONOSERVER} --pidfile /path/monoserve.pid --make-pidfile -- /applications=${WEBAPPS} /socket=unix:/path/monoserve.pid – user4069 Oct 6 '11 at 1:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy