5

What portable options do exist to drop root privileges and execute a given command as a different user from a shell script?

After doing a bit of research, here are a few non-options:

  • su $USER -c "$COMMAND" uses the PAM stack and creates a new cgroup (when run under systemd). It also fails in user namespaces, because the audit call returns -EPERM on older versions of Linux.
  • sudo -u $USER $COMMAND is not installed by default on many systems.
  • start-stop-daemon --pidfile /dev/null --start --chuid $USER --startas /bin/sh -- -c "$COMMAND" is very hard to use and only available on Debian systems.
  • chpst -u $USER $COMMAND is missing on many systems.
  • runuser -u $USER -- $COMMAND works where su doesn't, but requires recent util-linux.
2

2 Answers 2

3

If it's POSIX you want, then su is your only option (unless you want to write a C program). su has several advantages (or not, depending on your requirements):

  • It's a system tool which isn't going to forget about the new coffee UID introduced in Linux 3.42 (the UID for beverage drinking purposes) and which isn't going to goof by dropping user privileges before group privileges or to forget about capabilities.
  • It sets privileges to a known state: a user ID, that user's recorded group(s) from the user and group databases, no extra capabilities.
  • It records log entries.
  • And, again, it's completely standard, guaranteed to be available everywhere but on the most broken systems.

Now in practice some systems aren't POSIX — like this older Linux where it fails in user namespaces. Them's the breaks.

If you want something that's reasonably portable in practice (on non-embedded platforms) and that gives you a greater decree of control, use Perl (or Python, a bit less commonly installed). For preference, use a solid module: Privilege::Drop.

perl -e 'use Privileges::Drop; drop_uid_gid(123, 456); exec("/path/to/command", "--option", "an argument")'

Privilege::Drop takes care of doing things right (dropping supplemental groups, checking for errors). It might not be complete, however; for example it isn't aware of capabilities.

If you must do it by hand, take care of several things:

  • Drop group privileges before user privileges.
  • To drop supplemental groups, set $) = "456 456" where 456 is the target GID ($) = 456 would only set the EGID without affecting the supplemental groups).
  • Check the (E)[UG]ID afterwards and abort on failure.
2
  • If su is the way to go, what does it take to make su work again? Upgrading the kernel is the easy part, but the systemd part still bites. Commented Jun 16, 2014 at 21:31
  • 1
    @HelmutGrohne I don't know. I suggest asking on Unix & Linux where there are a few systemd afficionados (I'm not). Commented Jun 16, 2014 at 21:49
3

For folks who are reading this in a context where the relevant meaning of "POSIX shell script" is "POSIX sh script, being run on an arbitrary Linux system", as opposed to "sh script, run on a system guaranteed to have only tools guaranteed by POSIX", there are more options available.

Borrowing from an excellent answer to the UNIX & Linux question How do I drop root privileges in shell scripts:

  • Modern util-linux has setpriv, which can be used in the manner of:

    setpriv --reuid=user --regid=group --init-groups --inh-caps=-all yourcommand
    

The excellent article by @JdeBP Don't Abuse su For Dropping Privileges is also worth reading.

7
  • I have seen the linked article first, and it led me to this Q&A... because it seems to me like setuidgid is not actually a better tool for the job: It does not update the environment variables. e.g. $HOME will still be /root ... I am not convinced why it would be better than su. The setpriv tool you are recommending seems to have the --reset-env option, so thank you for the recommendation!
    – lucidbrot
    Commented Nov 1, 2022 at 20:14
  • But using su still seems a lot easier than getting all those flags right?
    – lucidbrot
    Commented Nov 1, 2022 at 20:23
  • 1
    su -c '...', in starting a shell, adds complexity (thus, room for bugs) that isn't there when you have a direct chain of execv'd argument lists; it makes it harder to safely parameterize the code being invoked than it should be, as one needs to know how to escape the command for the target shell. But bigger-picture, and more concerning, going up-then-down drops any prior containment work that may have been done to have a process running as a restricted form of root, vs root uncontained. Remember, there are capabilities, security contexts, &c in play today, not just the legacy model Commented Nov 1, 2022 at 20:35
  • 1
    ...and shell startup itself introduces new potential attack surface; if processes running as an unprivileged user are only ever invoked in a way that doesn't involve an interactive or login shell, then attacks involving dotfiles &c are off the table. Don't involve a shell at all and ENV / BASH_ENV &c are also off the table. Commented Nov 1, 2022 at 20:39
  • 1
    It's less wrong if you're starting from fully-capable root for sure, but it still forces you to start a shell and engages all the configurable moving pieces involved in PAM. Starting a shell isn't necessarily insecure, but it's certainly extra attack surface, so better to avoid when it's easy to do so; doubly so if one's parameterizing the command being invoked. Similarly, correctly-configured PAM rules enhance security, but it's still an increase in the number of things happening behind your back. Using a tool that's verbose about what it does keeps the moving parts in view. :) Commented Nov 1, 2022 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.