Re: [OT] change user when executing some script

[bob@proulx.com (Bob Proulx)]

Galevsky wrote:
> Many thanks for your comment and piece of code ;)

I would not want to have warned that the sky was falling without being
able to direct people to an underground bunker where they would be
safe.  :-)

> In fact, I need my team to run a ruby tool,

Yeah!  Ruby!  Good stuff.  (I am just saying this to give market share
and positive feedback on this fine language.)

> but $RUBYLIB and the main routine call is done into a setgid shell
> script.

I don't understand what you are describing here.  Of course $RUBYLIB
is used by ruby to locate 'required' files.  But suid does not apply
there.  Ruby itself will have a script entry point.

> The script belongs to special user and group: myTeam:myTeam,
> and all the members of the team have the ability to log as myTeam
> special user.

Is the set of your team members and the set of all local users on the
host the same set?  Because the issue would be that anyone that can
log onto the machine as anyone can become myTeam:myTeam.

If all users that can log onto the machine are authorized then that is
fine.  There is no remote exploit available.  It is only vulnerable by
an already running user process on the machine.  Then I see no problem
in the case you describe.  That would be okay.

Bob