How do I set the group (gid) of a process I'm about to launch?

Question

I'm porting a Debian init.d script to CentOS. In the Debian script, it uses start-stop-daemon for launching the process. The script uses start-stop-daemon's --group flag to change to a different group-id when starting the daemon process.

How do I set the group-id of the daemon process in the init script on CentOS?

Answer 1

If CentOS doesn't provide any better way (which would surprise me a little), you can fall back on su's lesser known counterpart, sg:

sg foogroup -c 'exec foodaemon --bar'

Answer 2

CentOS init scripts use /etc/init.d/functions, which declares a "daemon" function that most other init scripts use. But daemon doesn't accept any group flags.

It ends up calling:

$nice runuser -s /bin/bash - $user -c "$corelimit >/dev/null 2>&1 ; $*"

A quick /sbin/runuser --help shows that runuser accepts a flag to specify group, so try:

runuser -g $group; daemon ...

Answer 3

There is setuidgid: "setuidgid runs another program under a specified account's uid and gid."

It is part of daemontools, however, it probably is not available in the CentOS repositories due to DJBs strange licenses. So you might have to find a RPM (e.g. here) or build from source.

Answer 4

Very old question but I think I can add a few cents:

You can simply pay with the intrinsically flawed way daemon calls /sbin/runuser and set you username to something like:

echo -n "Starting ${prog}"
daemon --user='nobody -Gnogroup' $exec &
echo

And it will work.

It is particularly dirty but allows you to piggyback on daemon without having to call runuser directly (or twice).