rda-python-setuid 1.0.3__tar.gz → 1.0.5__tar.gz

{rda_python_setuid-1.0.3 → rda_python_setuid-1.0.5}/MANIFEST.in

@@ -1 +1,2 @@
 include src/rda_python_setuid/pywrapper.c
+include src/rda_python_setuid/install.usg

rda_python_setuid-1.0.5/PKG-INFO

@@ -0,0 +1,125 @@
+Metadata-Version: 2.4
+Name: rda_python_setuid
+Version: 1.0.5
+Summary: RDA Python Package to setuid for program executions as an effective or common user
+Author-email: Zaihua Ji <zji@ucar.edu>
+Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Development Status :: 5 - Production/Stable
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: rda_python_common
+Dynamic: license-file
+
+RDA Python package, including a C code wrapper, to execute commandline applications
+via setuid for effective and common user names.
+
+## Overview
+
+`rda_python_setuid` provides a C binary (`pywrapper`) that acquires a setuid effective
+user, then `execv`s a Python entry point script.  This allows Python programs to run
+as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
+
+Two modes are supported:
+
+- **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
+  as the common user.
+- **Mode 2 (pgstart specialist):** a copy `pgstart_zji` runs any command as specialist
+  `zji` via `pgstart.py`, restricted to authorized users.
+
+## Dependency requirement
+
+Any Python package whose programs are to be run via the setuid mechanism must declare
+`rda_python_setuid` as a dependency in its `pyproject.toml`:
+
+```toml
+[project]
+dependencies = [
+  "rda_python_setuid",
+  ...
+]
+```
+
+It must also register each wrapped program's connector entry point with a `setuid_`
+prefix:
+
+```toml
+[project.scripts]
+"setuid_dsarch" = "rda_python_dsarch.dsarch:main"
+```
+
+`pip install` then places `setuid_dsarch` in the environment's `bin/` directory
+automatically.  `pywrapper-install -l/--link` locks it down to `chmod 700` so users
+cannot bypass the setuid wrapper by running it directly.
+
+## Environment setup
+
+### Option A — Python venv (DECS machines)
+
+```bash
+python3 -m venv $ENVHOME          # e.g. /glade/u/home/gdexdata/gdexmsenv
+source $ENVHOME/bin/activate
+pip install rda_python_setuid rda_python_dsarch ...
+```
+
+### Option B — Conda (DAV/Casper)
+
+```bash
+conda create -n pg-gdex python=3.10
+conda activate pg-gdex
+pip install rda_python_setuid rda_python_dsarch ...
+```
+
+The conda environment is typically at `/glade/work/gdexdata/conda-envs/pg-gdex`.
+
+## Installation
+
+After setting up the environment and installing packages, run `pywrapper-install`
+with no arguments to display the full user guide:
+
+```bash
+pywrapper-install
+```
+
+### Full setuid setup (requires sudo access to CommonUser)
+
+```bash
+# 1. Install the target package (pulls in rda_python_setuid automatically):
+pip install rda_python_dsarch
+
+# 2. Compile pywrapper C binary (once per environment):
+pywrapper-install
+
+# 3. Wire up each program as a setuid entry:
+pywrapper-install -l dsarch
+
+# 4. Optionally, allow a specialist to run commands as themselves:
+pywrapper-install -p -u zji
+```
+
+### Simple install (no sudo required, runs as current user)
+
+Users who do not need the setuid mechanism can skip steps 2–4 and create a
+direct symlink from `dsarch` to `setuid_dsarch`:
+
+```bash
+pip install rda_python_dsarch
+pywrapper-install -l dsarch -s
+```
+
+## Runtime flow
+
+```
+user runs:  dsarch [args]
+              |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
+pywrapper.c:  execv(bin/setuid_dsarch, args)
+              |  (chmod 700, only gdexdata can exec directly)
+setuid_dsarch: calls dsarch:main() as gdexdata
+```
+
+## Github
+
+<https://github.com/NCAR/rda-python-setuid>

rda_python_setuid-1.0.5/README.md

@@ -0,0 +1,109 @@
+RDA Python package, including a C code wrapper, to execute commandline applications
+via setuid for effective and common user names.
+
+## Overview
+
+`rda_python_setuid` provides a C binary (`pywrapper`) that acquires a setuid effective
+user, then `execv`s a Python entry point script.  This allows Python programs to run
+as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
+
+Two modes are supported:
+
+- **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
+  as the common user.
+- **Mode 2 (pgstart specialist):** a copy `pgstart_zji` runs any command as specialist
+  `zji` via `pgstart.py`, restricted to authorized users.
+
+## Dependency requirement
+
+Any Python package whose programs are to be run via the setuid mechanism must declare
+`rda_python_setuid` as a dependency in its `pyproject.toml`:
+
+```toml
+[project]
+dependencies = [
+  "rda_python_setuid",
+  ...
+]
+```
+
+It must also register each wrapped program's connector entry point with a `setuid_`
+prefix:
+
+```toml
+[project.scripts]
+"setuid_dsarch" = "rda_python_dsarch.dsarch:main"
+```
+
+`pip install` then places `setuid_dsarch` in the environment's `bin/` directory
+automatically.  `pywrapper-install -l/--link` locks it down to `chmod 700` so users
+cannot bypass the setuid wrapper by running it directly.
+
+## Environment setup
+
+### Option A — Python venv (DECS machines)
+
+```bash
+python3 -m venv $ENVHOME          # e.g. /glade/u/home/gdexdata/gdexmsenv
+source $ENVHOME/bin/activate
+pip install rda_python_setuid rda_python_dsarch ...
+```
+
+### Option B — Conda (DAV/Casper)
+
+```bash
+conda create -n pg-gdex python=3.10
+conda activate pg-gdex
+pip install rda_python_setuid rda_python_dsarch ...
+```
+
+The conda environment is typically at `/glade/work/gdexdata/conda-envs/pg-gdex`.
+
+## Installation
+
+After setting up the environment and installing packages, run `pywrapper-install`
+with no arguments to display the full user guide:
+
+```bash
+pywrapper-install
+```
+
+### Full setuid setup (requires sudo access to CommonUser)
+
+```bash
+# 1. Install the target package (pulls in rda_python_setuid automatically):
+pip install rda_python_dsarch
+
+# 2. Compile pywrapper C binary (once per environment):
+pywrapper-install
+
+# 3. Wire up each program as a setuid entry:
+pywrapper-install -l dsarch
+
+# 4. Optionally, allow a specialist to run commands as themselves:
+pywrapper-install -p -u zji
+```
+
+### Simple install (no sudo required, runs as current user)
+
+Users who do not need the setuid mechanism can skip steps 2–4 and create a
+direct symlink from `dsarch` to `setuid_dsarch`:
+
+```bash
+pip install rda_python_dsarch
+pywrapper-install -l dsarch -s
+```
+
+## Runtime flow
+
+```
+user runs:  dsarch [args]
+              |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
+pywrapper.c:  execv(bin/setuid_dsarch, args)
+              |  (chmod 700, only gdexdata can exec directly)
+setuid_dsarch: calls dsarch:main() as gdexdata
+```
+
+## Github
+
+<https://github.com/NCAR/rda-python-setuid>

{rda_python_setuid-1.0.3 → rda_python_setuid-1.0.5}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rda_python_setuid"
-version = "1.0.3"
+version = "1.0.5"
 authors = [
   { name="Zaihua Ji", email="zji@ucar.edu" },
 ]
@@ -30,11 +30,12 @@ include-package-data = true
 where = ["src"]
 
 [tool.setuptools.package-data]
-"rda_python_setuid" = ["pywrapper.c"]
+"rda_python_setuid" = ["pywrapper.c", "install.usg"]
 
 [project.urls]
 "Homepage" = "https://github.com/NCAR/rda-python-setuid"
 
 [project.scripts]
-"pywrapper.py" = "rda_python_setuid.pywrapper:main"
+"setuid_pywrapper" = "rda_python_setuid.pywrapper:main"
 "pgstart.py" = "rda_python_setuid.pgstart:main"
+"pywrapper-install" = "rda_python_setuid.install:main"

rda_python_setuid-1.0.5/src/rda_python_setuid/install.py

@@ -0,0 +1,156 @@
+#!/usr/bin/env python3
+#
+##################################################################################
+#
+#     Title: pywrapper-install
+#    Author: Zaihua Ji, zji@ucar.edu
+#      Date: 2025-05-11
+#   Purpose: Install helper for the pywrapper setuid C binary.
+#            Replaces the manual gcc/chmod/ln steps with a single command.
+#
+#    Github: https://github.com/NCAR/rda-python-setuid.git
+#
+# Usage:
+#   # 1. Compile and install pywrapper (run once per environment):
+#   pywrapper-install [-u gdexdata] [-e $ENVHOME/bin/]
+#
+#   # 2. Create pgstart_USER entry so USER can run commands as themselves:
+#   pywrapper-install -p [-u zji] [-e $ENVHOME/bin/]
+#
+#   # 3. Create a symlink so a program runs as CommonUser via pywrapper (setuid):
+#   pywrapper-install -l myprog [-u gdexdata] [-e $ENVHOME/bin/]
+#
+#   # 4. Simple install: symlink PROGRAM -> setuid_PROGRAM (no setuid, runs as current user):
+#   pywrapper-install -l myprog -s [-e $ENVHOME/bin/]
+#
+# Convention for wrapped programs:
+#   The target package must register its connector entry point with a setuid_ prefix:
+#      [project.scripts]
+#      "setuid_dsarch" = "rda_python_dsarch.dsarch:main"
+#   pip install places setuid_dsarch in the bin dir automatically.
+#   pywrapper-install --link dsarch will chown setuid_dsarch to CommonUser and
+#   chmod 700, so users cannot run it directly and must go through the setuid wrapper.
+#   pywrapper-install --link dsarch --simple creates dsarch -> setuid_dsarch directly,
+#   skipping setuid; the program runs as the current user.
+#
+##################################################################################
+
+import argparse
+import os
+import shutil
+import subprocess
+import sys
+
+
+def get_bindir():
+   """Return the bin directory of the active Python environment."""
+   return os.path.dirname(os.path.abspath(sys.executable))
+
+
+def get_c_source():
+   """Return path to pywrapper.c bundled with this package."""
+   return os.path.join(os.path.dirname(__file__), 'pywrapper.c')
+
+
+def run(cmd):
+   print("  $", " ".join(cmd))
+   subprocess.run(cmd, check=True)
+
+
+def show_usage():
+   usgfile = os.path.join(os.path.dirname(__file__), 'install.usg')
+   os.system("more " + usgfile)
+   sys.exit(0)
+
+
+def main():
+
+   if len(sys.argv) == 1:
+      show_usage()
+
+   parser = argparse.ArgumentParser(
+      description="Compile and install the pywrapper setuid C binary."
+   )
+   parser.add_argument(
+      '-e', '--envhome', default=None,
+      help="Path to the venv bin/ directory (default: bin/ dir of the current Python executable)"
+   )
+   parser.add_argument(
+      '-u', '--user', default=None,
+      help="User name to own the setuid binary (default: current login user for -p/--pgstart, gdexdata otherwise)"
+   )
+   parser.add_argument(
+      '-s', '--simple', action='store_true',
+      help="Simple install: create symlink PROGRAM -> setuid_PROGRAM, skipping setuid (use with -l/--link)"
+   )
+   group = parser.add_mutually_exclusive_group()
+   group.add_argument(
+      '-p', '--pgstart', action='store_true',
+      help="Create pgstart_USER for running commands as USER (Mode 2)"
+   )
+   group.add_argument(
+      '-l', '--link', metavar='PROGRAM',
+      help="Create symlink PROGRAM -> pywrapper for running a fixed program as CommonUser (Mode 1)"
+   )
+   args = parser.parse_args()
+
+   if args.user is None and not args.simple:
+      import pwd
+      if args.pgstart:
+         args.user = pwd.getpwuid(os.getuid()).pw_name
+      else:
+         args.user = 'gdexdata'
+
+   bindir = args.envhome or get_bindir()
+   pywrapper = os.path.join(bindir, 'pywrapper')
+
+   if args.link:
+      target = os.path.join(bindir, args.link)
+      script = os.path.join(bindir, 'setuid_{}'.format(args.link))
+      if not os.path.exists(script):
+         print("Error: {} not found. Install the package that provides it first.".format(script))
+         sys.exit(1)
+      if args.simple:
+         # Simple install: symlink PROGRAM -> setuid_PROGRAM, no setuid, runs as current user.
+         if os.path.lexists(target):
+            print("Already exists: {}".format(target))
+         else:
+            os.symlink(script, target)
+            print("Created: {} -> setuid_{}".format(target, args.link))
+      else:
+         # Mode 1: symlink PROGRAM -> pywrapper, then lock down setuid_PROGRAM
+         # so users cannot bypass the setuid wrapper by running it directly.
+         if os.path.lexists(target):
+            print("Already exists: {}".format(target))
+         else:
+            os.symlink(pywrapper, target)
+            print("Created: {} -> pywrapper".format(target))
+         # chown and chmod 700: only CommonUser can execute setuid_PROGRAM directly.
+         # pywrapper (running as CommonUser via setuid) can still execv it, but any
+         # direct invocation by other users will get "permission denied".
+         run(['sudo', '-u', args.user, 'chown', args.user, script])
+         run(['sudo', '-u', args.user, 'chmod', '700', script])
+         print("Locked: {} (chmod 700, owned by {})".format(script, args.user))
+
+   elif args.pgstart:
+      # Mode 2: copy pywrapper to pgstart_USER with setuid owned by USER
+      if not os.path.exists(pywrapper):
+         print("Error: {} not found. Run pywrapper-install --user COMMONUSER first.".format(pywrapper))
+         sys.exit(1)
+      target = os.path.join(bindir, 'pgstart_{}'.format(args.user))
+      run(['sudo', '-u', args.user, 'cp', pywrapper, target])
+      run(['sudo', '-u', args.user, 'chmod', '4750', target])
+      print("Installed: {} (setuid, owned by {})".format(target, args.user))
+
+   else:
+      # Default: compile pywrapper.c and install pywrapper with setuid
+      src = get_c_source()
+      src_dest = os.path.join(bindir, 'pywrapper.c')
+      shutil.copy(src, src_dest)
+      print("Copied: {}".format(src_dest))
+      run(['sudo', '-u', args.user, 'gcc', '-o', pywrapper, src_dest])
+      run(['sudo', '-u', args.user, 'chmod', '4750', pywrapper])
+      print("Installed: {} (setuid, owned by {})".format(pywrapper, args.user))
+
+
+if __name__ == '__main__': main()

rda_python_setuid-1.0.5/src/rda_python_setuid/install.usg

@@ -0,0 +1,132 @@
+ Compile and install the pywrapper setuid C binary, and set up program entries
+ that execute Python scripts as a common or effective user via the setuid mechanism.
+ Must be run inside the target Python virtual environment.
+
+ Usage: pywrapper-install [-u USER] [-e BINDIR] [-p | -l PROGRAM [-s]]
+
+      - Option -u or --user USER
+          The user name to own the setuid binary.  For Mode 1 (CommonUser program),
+          this is the common user (e.g. gdexdata).  For Mode 2 (pgstart), this is
+          the specialist user (e.g. zji).  Defaults to 'gdexdata' unless -p/--pgstart
+          is given, in which case it defaults to the current login user.
+
+      - Option -e or --envhome BINDIR
+          Path to the venv bin/ directory.  Defaults to the bin/ directory of the
+          currently active Python executable.  Only needed when installing into an
+          environment other than the one currently active.
+
+      - Option -p or --pgstart
+          Mode 2: copy the compiled pywrapper binary to pgstart_USER (owned by USER,
+          chmod 4750).  Allows USER to run arbitrary commands as themselves via the
+          setuid wrapper.  Cannot be combined with -l/--link.
+
+      - Option -l or --link PROGRAM
+          Mode 1: create a symlink PROGRAM -> pywrapper in the bin/ directory, then
+          lock down setuid_PROGRAM (chmod 700, owned by USER) so users cannot bypass
+          the setuid wrapper by running setuid_PROGRAM directly.  Cannot be combined
+          with -p/--pgstart.
+
+      - Option -s or --simple (use with -l/--link)
+          Simple install: create a symlink PROGRAM -> setuid_PROGRAM directly,
+          skipping the setuid mechanism entirely.  The program runs as the current
+          user with no privilege change.  -u/--user is not required with this option.
+          Useful for users who do not need or cannot set up the setuid wrapper.
+
+ When run without --pgstart or --link, the default action is to compile pywrapper.c
+ (bundled with this package) and install it as bin/pywrapper, owned by USER with
+ chmod 4750 (setuid).  This step must be done once per environment before using
+ --pgstart or --link.
+
+ Convention for wrapped programs:
+   Any Python package whose program is to be run via pywrapper must:
+
+   1. Declare rda_python_setuid as a dependency in pyproject.toml:
+
+         [project]
+         dependencies = [
+           "rda_python_setuid",
+           ...
+         ]
+
+      This ensures pywrapper-install is available in the environment after
+      pip install.
+
+   2. Register its connector entry point with a setuid_ prefix in pyproject.toml:
+
+         [project.scripts]
+         "setuid_dsarch" = "rda_python_dsarch.dsarch:main"
+
+      pip install then places setuid_dsarch in the bin/ directory automatically.
+      Running pywrapper-install --link will lock it down (chmod 700) so that only
+      pywrapper (running as CommonUser via its setuid bit) can execv it.
+
+ Environment Setup:
+
+   Option A - Python venv (recommended for DECS machines):
+
+      1. Create and activate the virtual environment:
+            python3 -m venv $ENVHOME
+            source $ENVHOME/bin/activate
+
+      2. Install the required packages:
+            pip install rda_python_setuid rda_python_dsarch ...
+
+      3. Deactivate when done:
+            deactivate
+
+      $ENVHOME is typically /glade/u/home/gdexdata/gdexmsenv on DECS machines.
+
+   Option B - Conda (recommended for DAV/Casper):
+
+      1. Create and activate the conda environment:
+            conda create -n pg-gdex python=3.10
+            conda activate pg-gdex
+
+      2. Install the required packages:
+            pip install rda_python_setuid rda_python_dsarch ...
+
+      The conda environment is typically located at:
+            /glade/work/gdexdata/conda-envs/pg-gdex
+
+      Use 'conda activate pg-gdex' to activate it before running pywrapper-install.
+
+ Setup sequence for a new environment:
+
+   Option A - Full setuid setup (requires sudo access to CommonUser):
+
+   1. Install the target package and its dependencies:
+         pip install rda_python_dsarch
+
+   2. Compile pywrapper (once per environment):
+         pywrapper-install
+
+   3. Wire up each program as a setuid entry:
+         pywrapper-install -l dsarch
+
+   4. Optionally, allow a specialist to run commands as themselves:
+         pywrapper-install -p
+
+   Option B - Simple install (no sudo required, runs as current user):
+
+   1. Install the target package:
+         pip install rda_python_dsarch
+
+   2. Create a direct symlink to the connector script:
+         pywrapper-install -l dsarch -s
+
+ Examples:
+
+   1. Compile and install pywrapper for common user gdexdata (default):
+         pywrapper-install
+
+   2. Same, but targeting a specific environment:
+         pywrapper-install -e /glade/u/home/gdexdata/gdexmsenv/bin/
+
+   3. Wire up dsarch to run as gdexdata via pywrapper:
+         pywrapper-install -l dsarch
+
+   4. Allow specialist zji to run commands as themselves via pgstart:
+         pywrapper-install -p -u zji
+
+   5. Simple install of dsarch for a user who does not need setuid:
+         pywrapper-install -l dsarch -s

rda_python_setuid-1.0.5/src/rda_python_setuid/pgstart.py

@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+#
+##################################################################################
+#
+#     Title: pgstart
+#    Author: Zaihua Ji, zji@ucar.edu
+#      Date: 10/17/2020
+#            2025-03-18 transferred to package rda_python_setuid from
+#            https://github.com/NCAR/rda-utility-programs.git
+#   Purpose: python script to start up an application in background
+#            for individual specialist
+#
+#    Github: https://github.com/NCAR/rda-python-setuid.git
+#
+##################################################################################
+
+import os
+import sys
+import re
+import pwd
+import subprocess
+from rda_python_common.pg_log import PgLOG
+
+def main():
+   """Entry point for pgstart.
+
+   Checks whether the real user is authorized (must be the effective user or
+   the GDEX common user), then executes the supplied command as the effective
+   user.  Supports foreground/background execution and optional working-directory
+   change via command-line options.
+
+   Options (prefix with '-'):
+      bg   -- run command in background (non-blocking)
+      fg   -- run command in foreground (default, no-op flag)
+      cwd  -- change to the next argument as working directory before running
+      env  -- print environment variables and exit
+      inc  -- print sys.path include paths and exit
+      plg  -- print PGLOG variables and exit
+   """
+   pglog = PgLOG()
+   permit = False
+   pglog.PGLOG['LOGFILE'] = "pgstart.log"
+   aname = PgLOG.get_command()
+   bckgrd = False
+   workdir = None
+   argv = sys.argv[1:]
+
+   ruid = pglog.PGLOG['RUID']
+   euid = pglog.PGLOG['EUID']
+   ruser = pwd.getpwuid(ruid).pw_name
+   euser = pwd.getpwuid(euid).pw_name
+   if ruser == euser or ruser == pglog.PGLOG['GDEXUSER']: permit = True
+   pglog.set_suid(euid)
+
+   while argv:
+      ms = re.match(r'^-(\w+)$', argv[0])
+      if not ms: break
+      argv.pop(0)
+      opt = ms.group(1)
+      if opt == "bg":
+         bckgrd = True
+      elif opt == "cwd":
+         if argv: workdir = argv.pop(0)
+      elif opt != "fg":
+         display_message(pglog, opt)
+
+   if not (permit and argv):
+      print("********************************************************************")
+      print("* Your Login Name is {}({}) & Effective User Name is {}({}).".format(ruser, ruid, euser, euid))
+      print("* Pass a command or options -(bg|fg|cwd|env|inc|plg) to run '{}'.".format(aname))
+      if not permit:
+         print("* You must be '{}' or '{}' to execute a command as user '{}'.".format(euser, pglog.PGLOG['GDEXUSER'], euser))
+      print("********************************************************************")
+      sys.exit(0)
+
+   cmd = pglog.argv_to_string(argv)
+
+   msg = "{}-{}{}-{}".format(pglog.PGLOG['HOSTNAME'], aname, pglog.current_datetime(), pglog.PGLOG['CURUID'])
+   if workdir:
+      msg += "-" + workdir
+      os.chdir(workdir)
+
+   pglog.pglog("{}: {}".format(msg, cmd), PgLOG.MSGLOG)
+   if bckgrd:
+      subprocess.Popen(argv)
+   else:
+      subprocess.run(argv)
+   sys.exit(0)
+
+def display_message(pglog, option):
+   """Print diagnostic information for the given option and exit.
+
+   Args:
+      pglog (PgLOG): Initialized PgLOG instance.
+      option (str): One of 'env' (environment variables), 'inc' (sys.path),
+                    or 'plg' (PGLOG dict).  Prints an error for unknown values.
+   """
+   if option == "env":
+      print("Environment Variables:")
+      for ename in sorted(os.environ):
+         print("{}: {}".format(ename, os.environ[ename]))
+   elif option == "inc":
+      print("Including Paths:")
+      for pname in sorted(sys.path):
+         print(pname)
+   elif option == "plg":
+      print("PGLOG variables:")
+      for vname in sorted(pglog.PGLOG):
+         print("{}: {}".format(vname, pglog.PGLOG[vname]))
+   else:
+      print("* {}: Unknown option".format(option))
+
+   sys.exit(0)
+
+#
+# call main() to start program
+#
+if __name__ == "__main__": main()

rda_python_setuid-1.0.5/src/rda_python_setuid/pywrapper.c

@@ -0,0 +1,115 @@
+/***************************************************************************************\
+ *
+ *    Title: pywrapper.c
+ *   Author: Zaihua Ji, zji@ucar.edu
+ *     Date: 2025-03-17
+ *  Purpose: C wrapper to start any executable python code as an effective user
+ *
+ * Instruction:
+ *    python -m venv $ENVHOME
+ *    python -m pip install rda_python_setuid
+ *
+ *    # Compile pywrapper and set setuid bit (owned by CommonUser):
+ *    pywrapper-install [-u CommonUser] [-e $ENVHOME/bin]
+ *
+ *    # For an existing python program, $ENVHOME/bin/setuid_CommonProgram, to execute it
+ *    # as the common user (Mode 1 - symlink):
+ *    pywrapper-install -l CommonProgram [-u CommonUser] [-e $ENVHOME/bin]
+ *    CommonProgram [options]
+ *
+ *    # For a specialist to run commands as themselves via pgstart (Mode 2):
+ *    pywrapper-install -p [-u EffectUser] [-e $ENVHOME/bin]
+ *    pgstart_EffectUser EffectProgram [options]
+ *
+ *           N: python 3 release number, it is 10 for Python 3.10.12
+ *  CommonUser: a common user login name, such as gdexdata, for GDEXMS configuration
+ *  EffectUser: any user login name in the same group of the common user
+ *    $ENVHOME: /glade/u/home/gdexdata/gdexmsenv (venv) on DECS machines, and
+ *              /glade/work/gdexdata/conda-envs/pg-gdex (conda) on DAV
+ *
+ * Convention:
+ *    Any Python package whose program is to be run via pywrapper must register
+ *    its connector entry point with a setuid_ prefix in pyproject.toml, e.g.:
+ *       [project.scripts]
+ *       "setuid_dsarch" = "rda_python_dsarch.dsarch:main"
+ *    pip install places setuid_dsarch in $ENVHOME/bin/.  pywrapper locates it by
+ *    prepending setuid_ to the invoked program name.  No manual script creation needed.
+ *    pywrapper-install -l/--link will chown setuid_dsarch to CommonUser and chmod 700,
+ *    preventing direct execution by other users while still allowing pywrapper
+ *    (which runs with EUID=CommonUser via the setuid bit) to execv it.
+ *
+ \***************************************************************************************/
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <libgen.h>
+
+int is_executable(const char *filename) {
+   struct stat sb;
+
+   if(stat(filename, &sb) == 0 && sb.st_mode & S_IXUSR) {
+      return 1;
+   } else {
+      return 0;
+   }
+}
+
+/* main program */
+int main(int argc, char *argv[]) {
+   char *name;
+   char cname[80], prog[PATH_MAX];
+   char exepath[PATH_MAX];
+   char *fpath;
+   ssize_t exelen;
+   char pgstart[] = "pgstart";
+   char **apntr = argv;
+
+   exelen = readlink("/proc/self/exe", exepath, sizeof(exepath) - 1);
+   if(exelen == -1) {
+      perror("readlink /proc/self/exe");
+      exit(1);
+   }
+   exepath[exelen] = '\0';
+   fpath = dirname(exepath);
+
+   name = strrchr(argv[0], '/');
+   strncpy(cname, (name == NULL ? argv[0] : ++name), sizeof(cname) - 1);
+   cname[sizeof(cname) - 1] = '\0';
+
+   if(strstr(cname, pgstart) == cname) {
+      if(argc == 1 || argv[1][0] == '-') {
+         strncpy(cname, pgstart, sizeof(cname) - 1);
+      } else {
+         argv += 1;
+         name = strrchr(argv[0], '/');
+         strncpy(cname, (name == NULL ? argv[0] : ++name), sizeof(cname) - 1);
+         cname[sizeof(cname) - 1] = '\0';
+      }
+   }
+   if(snprintf(prog, sizeof(prog), "%s/setuid_%s", fpath, cname) >= (int)sizeof(prog)) {
+      fprintf(stderr, "pywrapper: path too long\n");
+      exit(1);
+   }
+   if(is_executable(prog) == 0) {
+      /* fall back to cname.py for backward compatibility */
+      if(snprintf(prog, sizeof(prog), "%s/%s.py", fpath, cname) >= (int)sizeof(prog)) {
+         fprintf(stderr, "pywrapper: path too long\n");
+         exit(1);
+      }
+      if(is_executable(prog) == 0) {
+         if(snprintf(prog, sizeof(prog), "%s/pgstart.py", fpath) >= (int)sizeof(prog)) {
+            fprintf(stderr, "pywrapper: path too long\n");
+            exit(1);
+         }
+         argv = apntr;
+      }
+   }
+   execv(prog, argv);  /* call Python script */
+   perror(prog);       /* execv only returns on error */
+   exit(1);
+}

{rda_python_setuid-1.0.3 → rda_python_setuid-1.0.5}/src/rda_python_setuid/pywrapper.py

@@ -17,15 +17,23 @@
 import os
 import sys
 import pwd
-from rda_python_common import PgLOG
+from rda_python_common.pg_log import PgLOG
 
-#
-# main function to excecute this script
-#
 def main():
+   """Entry point for setuid_pywrapper (the default pywrapper.c fallback target).
+
+   When pywrapper.c cannot find a matching setuid_<program> entry point, it
+   falls back to executing this script.  Prints UID information and setup
+   instructions, or dumps diagnostic information when a flag is supplied.
 
-   PgLOG.set_suid(PgLOG.PGLOG['EUID'])
-   inc = 1
+   Options:
+      -env  -- print environment variables and exit
+      -inc  -- print sys.path include paths and exit
+      -plg  -- print PGLOG variables and exit
+   """
+   pglog = PgLOG()
+   pglog.set_suid(pglog.PGLOG['EUID'])
+   inc = True
    print("********************************************************************")
    argv = sys.argv[1:]
    if argv:
@@ -33,35 +41,37 @@ def main():
          print("Environment Variables:")
          for ename in sorted(os.environ):
             print("{}: {}".format(ename, os.environ[ename]))
-         inc = 0
+         inc = False
       elif argv[0] == "-inc":
          print("Including Paths:")
          for pname in sorted(sys.path):
             print(pname)
-         inc = 0
+         inc = False
       elif argv[0] == "-plg":
          print("PGLOG variables:")
-         for vname in sorted(PgLOG.PGLOG):
-            print("{}: {}".format(vname, PgLOG.PGLOG[vname]))
-         inc = 0
+         for vname in sorted(pglog.PGLOG):
+            print("{}: {}".format(vname, pglog.PGLOG[vname]))
+         inc = False
       else:
          print("* {}: Unknown option".format(argv[0]))
    else:
-      ruid = PgLOG.PGLOG['RUID']
-      euid = PgLOG.PGLOG['EUID']
+      ruid = pglog.PGLOG['RUID']
+      euid = pglog.PGLOG['EUID']
       ruser = pwd.getpwuid(ruid).pw_name
       euser = pwd.getpwuid(euid).pw_name
-      print("* Your Login Name is {}({}) & Effective User Name is {}({}).".format(ruser, ruid, euser,euid))
-      print("* To wrap your python script 'yourscript.py', you install it as")
-      print("* an executable under $ENVHOME/bin/ and create a link to 'pywrapper'")
-      print("* under $ENVHOME/bin/ as 'ln -s pywrapper yourscript'.")
+      print("* Your Login Name is {}({}) & Effective User Name is {}({}).".format(ruser, ruid, euser, euid))
+      print("* To wrap a Python program 'yourscript', register its entry point")
+      print("* with a setuid_ prefix in pyproject.toml:")
+      print("*    [project.scripts]")
+      print("*    \"setuid_yourscript\" = \"your_package.module:main\"")
+      print("* Then run: pywrapper-install -l yourscript")
    if inc:
       print("* Include -env to show environment variables")
       print("* Include -inc to show included paths")
       print("* Include -plg to show PGLOG variables")
-   
+
    print("********************************************************************\n")
-   
+
    sys.exit(0)
 
 #

rda_python_setuid-1.0.5/src/rda_python_setuid.egg-info/PKG-INFO

@@ -0,0 +1,125 @@
+Metadata-Version: 2.4
+Name: rda_python_setuid
+Version: 1.0.5
+Summary: RDA Python Package to setuid for program executions as an effective or common user
+Author-email: Zaihua Ji <zji@ucar.edu>
+Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Development Status :: 5 - Production/Stable
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: rda_python_common
+Dynamic: license-file
+
+RDA Python package, including a C code wrapper, to execute commandline applications
+via setuid for effective and common user names.
+
+## Overview
+
+`rda_python_setuid` provides a C binary (`pywrapper`) that acquires a setuid effective
+user, then `execv`s a Python entry point script.  This allows Python programs to run
+as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
+
+Two modes are supported:
+
+- **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
+  as the common user.
+- **Mode 2 (pgstart specialist):** a copy `pgstart_zji` runs any command as specialist
+  `zji` via `pgstart.py`, restricted to authorized users.
+
+## Dependency requirement
+
+Any Python package whose programs are to be run via the setuid mechanism must declare
+`rda_python_setuid` as a dependency in its `pyproject.toml`:
+
+```toml
+[project]
+dependencies = [
+  "rda_python_setuid",
+  ...
+]
+```
+
+It must also register each wrapped program's connector entry point with a `setuid_`
+prefix:
+
+```toml
+[project.scripts]
+"setuid_dsarch" = "rda_python_dsarch.dsarch:main"
+```
+
+`pip install` then places `setuid_dsarch` in the environment's `bin/` directory
+automatically.  `pywrapper-install -l/--link` locks it down to `chmod 700` so users
+cannot bypass the setuid wrapper by running it directly.
+
+## Environment setup
+
+### Option A — Python venv (DECS machines)
+
+```bash
+python3 -m venv $ENVHOME          # e.g. /glade/u/home/gdexdata/gdexmsenv
+source $ENVHOME/bin/activate
+pip install rda_python_setuid rda_python_dsarch ...
+```
+
+### Option B — Conda (DAV/Casper)
+
+```bash
+conda create -n pg-gdex python=3.10
+conda activate pg-gdex
+pip install rda_python_setuid rda_python_dsarch ...
+```
+
+The conda environment is typically at `/glade/work/gdexdata/conda-envs/pg-gdex`.
+
+## Installation
+
+After setting up the environment and installing packages, run `pywrapper-install`
+with no arguments to display the full user guide:
+
+```bash
+pywrapper-install
+```
+
+### Full setuid setup (requires sudo access to CommonUser)
+
+```bash
+# 1. Install the target package (pulls in rda_python_setuid automatically):
+pip install rda_python_dsarch
+
+# 2. Compile pywrapper C binary (once per environment):
+pywrapper-install
+
+# 3. Wire up each program as a setuid entry:
+pywrapper-install -l dsarch
+
+# 4. Optionally, allow a specialist to run commands as themselves:
+pywrapper-install -p -u zji
+```
+
+### Simple install (no sudo required, runs as current user)
+
+Users who do not need the setuid mechanism can skip steps 2–4 and create a
+direct symlink from `dsarch` to `setuid_dsarch`:
+
+```bash
+pip install rda_python_dsarch
+pywrapper-install -l dsarch -s
+```
+
+## Runtime flow
+
+```
+user runs:  dsarch [args]
+              |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
+pywrapper.c:  execv(bin/setuid_dsarch, args)
+              |  (chmod 700, only gdexdata can exec directly)
+setuid_dsarch: calls dsarch:main() as gdexdata
+```
+
+## Github
+
+<https://github.com/NCAR/rda-python-setuid>

{rda_python_setuid-1.0.3 → rda_python_setuid-1.0.5}/src/rda_python_setuid.egg-info/SOURCES.txt

@@ -3,6 +3,8 @@ MANIFEST.in
 README.md
 pyproject.toml
 src/rda_python_setuid/__init__.py
+src/rda_python_setuid/install.py
+src/rda_python_setuid/install.usg
 src/rda_python_setuid/pgstart.py
 src/rda_python_setuid/pywrapper.c
 src/rda_python_setuid/pywrapper.py

rda_python_setuid-1.0.5/src/rda_python_setuid.egg-info/entry_points.txt

@@ -0,0 +1,4 @@
+[console_scripts]
+pgstart.py = rda_python_setuid.pgstart:main
+pywrapper-install = rda_python_setuid.install:main
+setuid_pywrapper = rda_python_setuid.pywrapper:main

rda_python_setuid-1.0.3/PKG-INFO

@@ -1,17 +0,0 @@
-Metadata-Version: 2.4
-Name: rda_python_setuid
-Version: 1.0.3
-Summary: RDA Python Package to setuid for program executions as an effective or common user
-Author-email: Zaihua Ji <zji@ucar.edu>
-Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
-Classifier: Programming Language :: Python :: 3
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Operating System :: OS Independent
-Classifier: Development Status :: 5 - Production/Stable
-Requires-Python: >=3.7
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: rda_python_common
-Dynamic: license-file
-
-RDA python package, including a C code wrapper, to execute commandline applications via setuid for effective and common user names. 

rda_python_setuid-1.0.3/README.md

@@ -1 +0,0 @@
-RDA python package, including a C code wrapper, to execute commandline applications via setuid for effective and common user names. 

rda_python_setuid-1.0.3/src/rda_python_setuid/pgstart.py

@@ -1,99 +0,0 @@
-#!/usr/bin/env python3
-#
-##################################################################################
-#
-#     Title: pgstart
-#    Author: Zaihua Ji, zji@ucar.edu
-#      Date: 10/17/2020
-#            2025-03-18 transferred to package rda_python_setuid from
-#            https://github.com/NCAR/rda-utility-programs.git
-#   Purpose: python script to start up an application in background
-#            for individual specialist
-#
-#    Github: https://github.com/NCAR/rda-python-setuid.git
-#
-##################################################################################
-
-import os
-import sys
-import re
-import pwd
-from rda_python_common import PgLOG
-
-#
-# main function to excecute this script
-#
-def main():
-
-   permit = 1
-   PgLOG.PGLOG['LOGFILE'] = "pgstart.log"
-   aname = PgLOG.get_command()
-   bckgrd = ""
-   workdir = None
-   argv = sys.argv[1:]
-
-   PgLOG.set_suid(PgLOG.PGLOG['EUID'])
-   if PgLOG.PGLOG['CURUID'] != PgLOG.PGLOG['RDAUSER'] and PgLOG.PGLOG['CURUID'] != "zji": permit = 0
-
-   while argv:
-      ms = re.match(r'^-(\w+)$', argv[0])
-      if not ms: break
-      argv.pop(0)
-      opt = ms.group(1)
-      if opt == "bg":
-         bckgrd = " &"
-      elif opt == "cwd":
-         if argv: workdir = argv.pop(0)
-      elif opt != "fg":
-         display_message(opt)
-
-   if not (permit and argv):
-      ruid = PgLOG.PGLOG['RUID']
-      euid = PgLOG.PGLOG['EUID']
-      ruser = pwd.getpwuid(ruid).pw_name
-      euser = pwd.getpwuid(euid).pw_name
-      print("********************************************************************")
-      print("* Your Login Name is {}({}) & Effective User Name is {}({}).".format(ruser, ruid, euser, euid))
-      print("* Pass a command or options -(plg|env|inc) to run '{}'.".format(aname))
-      if not permit:
-         print("* You must be '{}' to execute a command as user '{}'.".format(PgLOG.PGLOG['RDAUSER'], euser))
-      print("********************************************************************")
-      sys.exit(0)
-
-   cmd = PgLOG.argv_to_string(argv)
-   
-   msg = "{}-{}{}-{}".format(PgLOG.PGLOG['HOSTNAME'], aname, PgLOG.current_datetime(), PgLOG.PGLOG['CURUID'])
-   if workdir:
-      msg += "-" + workdir
-      os.chdir(workdir)
-
-   PgLOG.pglog("{}: {}".format(msg, cmd), PgLOG.MSGLOG)
-   os.system(cmd + bckgrd)
-   sys.exit(0)
-
-#
-#  display message acording to the option passed in
-#
-def display_message(option):
-
-   if option == "env":
-      print("Environment Variables:")
-      for ename in sorted(os.environ):
-         print("{}: {}".format(ename, os.environ[ename]))
-   elif option == "inc":
-      print("Including Paths:")
-      for pname in sorted(sys.path):
-         print(pname)
-   elif option == "plg":
-      print("PGLOG variables:")
-      for vname in sorted(PgLOG.PGLOG):
-         print("{}: {}".format(vname, PgLOG.PGLOG[vname]))
-   else:
-      print("* {}: Unknown option".format(option))
-
-   sys.exit(0)
-
-#
-# call main() to start program
-#
-if __name__ == "__main__": main()

rda_python_setuid-1.0.3/src/rda_python_setuid/pywrapper.c

@@ -1,79 +0,0 @@
-/***************************************************************************************\
- *
- *    Title: pywrapper.c
- *   Author: Zaihua Ji, zji@ucar.edu
- *     Date: 2025-03-17
- *  Purpose: C wrapper to start any executable python code as an effective user
- *
- * Instruction:
- *    python -m venv $ENVHOME
- *    python -m pip install rda_python_setuid
- *    cd $ENVHOME/bin/
- *    cp ../lib/python3.N/site-packages/rda_python_setuid/pywrapper.c ./
- *    sudo -u CommonUser gcc -o pywrapper $ENVHOME/bin/pywrapper.c
- *    sudo -u CommonUser chmod 4750 pywrapper
- *
- *    For an existing python program, $ENVHOME/bin/CommonProgram.py, to execute it
- *    as the common user:
- *    sudo -u CommonUser ln -s pywrapper CommonProgram
- *    CommonProgram [options]
- *
- *    For an existing python program, $ENVHOME/bin/EffectProgram.py, to execute it
- *    as the effective user:
- *    sudo -u EffectUser cp pywrapper pgstart_EffectUser
- *    sudo -u EffectUser chmod 4750 pgstart_EffectUser
- *    pgstart_EffectUser EffectProgram [options]
- *
- *           N: python 3 release number, it is 10 for Python 3.10.12
- *  CommonUser: a common user login name, such as rdadata, for RDAMS configuration
- *  EffectUser: any user login name in the same group of the common user
- *    $ENVHOME: /glade/u/home/rdadata/rdamsenv (venv) on DECS machines, and
- *              /glade/work/rdadata/conda-envs/pg-rda (conda) on DAV
- *
- \***************************************************************************************/
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <string.h>
-#include <libgen.h>
-
-int is_executable(const char *filename) {
-   struct stat sb;
-
-   if(stat(filename, &sb) == 0 && sb.st_mode & S_IXUSR) {
-      return 1;
-   } else {
-      return 0;
-   }
-}
-
-/* main program */
-int main(int argc, char *argv[]) {
-   char *name;
-   char cname[80], prog[255];
-   char file[] = __FILE__;
-   char *fpath = dirname(file);
-   char pgstart[] = "pgstart";
-   char **apntr = argv;
-
-   name = strrchr(argv[0], '/');
-   strcpy(cname, (name == NULL ? argv[0] : ++name));
-
-   if(strstr(cname, pgstart) == cname) {
-      if(argc == 1 || argv[1][0] == '-') {
-         strcpy(cname, pgstart);
-      } else {
-         argv += 1;
-         name = strrchr(argv[0], '/');
-         strcpy(cname, (name == NULL ? argv[0] : ++name));
-      }
-   }
-   sprintf(prog, "%s/%s.py", fpath, cname);
-   if(is_executable(prog) == 0) {
-      sprintf(prog, "%s/pgstart.py", fpath);
-      argv = apntr;
-   }
-   execv(prog, argv);  /* call Python script */
-}

rda_python_setuid-1.0.3/src/rda_python_setuid.egg-info/PKG-INFO

@@ -1,17 +0,0 @@
-Metadata-Version: 2.4
-Name: rda_python_setuid
-Version: 1.0.3
-Summary: RDA Python Package to setuid for program executions as an effective or common user
-Author-email: Zaihua Ji <zji@ucar.edu>
-Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
-Classifier: Programming Language :: Python :: 3
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Operating System :: OS Independent
-Classifier: Development Status :: 5 - Production/Stable
-Requires-Python: >=3.7
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: rda_python_common
-Dynamic: license-file
-
-RDA python package, including a C code wrapper, to execute commandline applications via setuid for effective and common user names. 

rda_python_setuid-1.0.3/src/rda_python_setuid.egg-info/entry_points.txt

@@ -1,3 +0,0 @@
-[console_scripts]
-pgstart.py = rda_python_setuid.pgstart:main
-pywrapper.py = rda_python_setuid.pywrapper:main