rda-python-setuid 1.0.6__tar.gz → 1.0.8__tar.gz

{rda_python_setuid-1.0.6/src/rda_python_setuid.egg-info → rda_python_setuid-1.0.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 1.0.6
+Version: 1.0.8
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -30,6 +30,28 @@ Two modes are supported:
 - **Mode 2 (pgstart specialist):** a copy `pgstart_zji` runs any command as specialist
   `zji` via `pgstart.py`, restricted to authorized users.
 
+Two Python entry points are packaged alongside the C wrapper:
+
+- **`pywrapper.py`** — the default fallback target executed when `pywrapper.c`
+  cannot resolve a matching `setuid_<program>` entry point.  Acquires the
+  effective UID via `PgLOG.set_suid()`, prints the caller's real and effective
+  user names, and shows the `pyproject.toml` snippet plus the
+  `pywrapper-install -l <program>` command needed to wrap a new script.
+  Diagnostic flags `-env`, `-inc`, and `-plg` dump the environment variables,
+  `sys.path`, and `PGLOG` dictionary respectively — handy for verifying the
+  setuid environment before wiring up a real program.
+
+- **`pgstart.py`** — the Mode 2 launcher invoked through a `pgstart_<USER>`
+  copy of `pywrapper`.  Reads the real/effective UIDs from `PGLOG`, then
+  permits execution only if the real user matches the effective user or the
+  shared GDEX common user (`PGLOG['GDEXUSER']`); unauthorized callers receive
+  an informational message and exit.  After authorization it parses leading
+  flag tokens — `-bg` (background via `subprocess.Popen`), `-fg` (explicit
+  foreground, default), `-cwd <dir>` (chdir before exec), and the same
+  `-env`/`-inc`/`-plg` diagnostics as `pywrapper.py` — and then runs the
+  remaining arguments as a command (`subprocess.run`/`Popen`) under the
+  effective UID, logging a host/program/timestamp/user line to `pgstart.log`.
+
 ## Dependency requirement
 
 Any Python package whose programs are to be run via the setuid mechanism must declare
@@ -91,13 +113,13 @@ pywrapper-install
 pip install rda_python_dsarch
 
 # 2. Compile pywrapper C binary (once per environment):
-pywrapper-install
+pywrapper-install -c|--compile
 
 # 3. Wire up each program as a setuid entry:
-pywrapper-install -l dsarch
+pywrapper-install -l|--link dsarch
 
 # 4. Optionally, allow a specialist to run commands as themselves:
-pywrapper-install -p -u zji
+pywrapper-install -p|--pgstart -u|--user zji
 ```
 
 ### Simple install (no sudo required, runs as current user)
@@ -107,7 +129,7 @@ direct symlink from `dsarch` to `setuid_dsarch`:
 
 ```bash
 pip install rda_python_dsarch
-pywrapper-install -l dsarch -s
+pywrapper-install -l|--link dsarch -s|--simple
 ```
 
 ## Runtime flow

{rda_python_setuid-1.0.6 → rda_python_setuid-1.0.8}/README.md

@@ -14,6 +14,28 @@ Two modes are supported:
 - **Mode 2 (pgstart specialist):** a copy `pgstart_zji` runs any command as specialist
   `zji` via `pgstart.py`, restricted to authorized users.
 
+Two Python entry points are packaged alongside the C wrapper:
+
+- **`pywrapper.py`** — the default fallback target executed when `pywrapper.c`
+  cannot resolve a matching `setuid_<program>` entry point.  Acquires the
+  effective UID via `PgLOG.set_suid()`, prints the caller's real and effective
+  user names, and shows the `pyproject.toml` snippet plus the
+  `pywrapper-install -l <program>` command needed to wrap a new script.
+  Diagnostic flags `-env`, `-inc`, and `-plg` dump the environment variables,
+  `sys.path`, and `PGLOG` dictionary respectively — handy for verifying the
+  setuid environment before wiring up a real program.
+
+- **`pgstart.py`** — the Mode 2 launcher invoked through a `pgstart_<USER>`
+  copy of `pywrapper`.  Reads the real/effective UIDs from `PGLOG`, then
+  permits execution only if the real user matches the effective user or the
+  shared GDEX common user (`PGLOG['GDEXUSER']`); unauthorized callers receive
+  an informational message and exit.  After authorization it parses leading
+  flag tokens — `-bg` (background via `subprocess.Popen`), `-fg` (explicit
+  foreground, default), `-cwd <dir>` (chdir before exec), and the same
+  `-env`/`-inc`/`-plg` diagnostics as `pywrapper.py` — and then runs the
+  remaining arguments as a command (`subprocess.run`/`Popen`) under the
+  effective UID, logging a host/program/timestamp/user line to `pgstart.log`.
+
 ## Dependency requirement
 
 Any Python package whose programs are to be run via the setuid mechanism must declare
@@ -75,13 +97,13 @@ pywrapper-install
 pip install rda_python_dsarch
 
 # 2. Compile pywrapper C binary (once per environment):
-pywrapper-install
+pywrapper-install -c|--compile
 
 # 3. Wire up each program as a setuid entry:
-pywrapper-install -l dsarch
+pywrapper-install -l|--link dsarch
 
 # 4. Optionally, allow a specialist to run commands as themselves:
-pywrapper-install -p -u zji
+pywrapper-install -p|--pgstart -u|--user zji
 ```
 
 ### Simple install (no sudo required, runs as current user)
@@ -91,7 +113,7 @@ direct symlink from `dsarch` to `setuid_dsarch`:
 
 ```bash
 pip install rda_python_dsarch
-pywrapper-install -l dsarch -s
+pywrapper-install -l|--link dsarch -s|--simple
 ```
 
 ## Runtime flow

{rda_python_setuid-1.0.6 → rda_python_setuid-1.0.8}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rda_python_setuid"
-version = "1.0.6"
+version = "1.0.8"
 authors = [
   { name="Zaihua Ji", email="zji@ucar.edu" },
 ]

{rda_python_setuid-1.0.6 → rda_python_setuid-1.0.8}/src/rda_python_setuid/install.py

@@ -11,8 +11,11 @@
 #    Github: https://github.com/NCAR/rda-python-setuid.git
 #
 # Usage:
+#   # 0. Display this user guide:
+#   pywrapper-install
+#
 #   # 1. Compile and install pywrapper (run once per environment):
-#   pywrapper-install [-u gdexdata] [-e $ENVHOME]
+#   pywrapper-install -c [-u gdexdata] [-e $ENVHOME]
 #
 #   # 2. Create pgstart_USER entry so USER can run commands as themselves:
 #   pywrapper-install -p [-u zji] [-e $ENVHOME]
@@ -65,9 +68,6 @@ def show_usage():
 
 def main():
 
-   if len(sys.argv) == 1:
-      show_usage()
-
    parser = argparse.ArgumentParser(
       description="Compile and install the pywrapper setuid C binary."
    )
@@ -84,6 +84,10 @@ def main():
       help="Simple install: create symlink PROGRAM -> setuid_PROGRAM, skipping setuid (use with -l/--link)"
    )
    group = parser.add_mutually_exclusive_group()
+   group.add_argument(
+      '-c', '--compile', action='store_true',
+      help="Compile pywrapper.c and install bin/pywrapper as a setuid binary (run once per environment)"
+   )
    group.add_argument(
       '-p', '--pgstart', action='store_true',
       help="Create pgstart_USER for running commands as USER (Mode 2)"
@@ -94,6 +98,9 @@ def main():
    )
    args = parser.parse_args()
 
+   if not (args.compile or args.pgstart or args.link):
+      show_usage()
+
    if args.user is None and not args.simple:
       import pwd
       if args.pgstart:
@@ -142,8 +149,8 @@ def main():
       run(['sudo', '-u', args.user, 'chmod', '4750', target])
       print("Installed: {} (setuid, owned by {})".format(target, args.user))
 
-   else:
-      # Default: compile pywrapper.c and install pywrapper with setuid
+   elif args.compile:
+      # Compile pywrapper.c and install pywrapper with setuid
       src = get_c_source()
       src_dest = os.path.join(bindir, 'pywrapper.c')
       shutil.copy(src, src_dest)

{rda_python_setuid-1.0.6 → rda_python_setuid-1.0.8}/src/rda_python_setuid/install.usg

@@ -2,7 +2,14 @@
  that execute Python scripts as a common or effective user via the setuid mechanism.
  Must be run inside the target Python virtual environment.
 
- Usage: pywrapper-install [-u USER] [-e ENVHOME] [-p | -l PROGRAM [-s]]
+ Usage: pywrapper-install [-u|--user USER] [-e|--envhome ENVHOME]
+                          ( -c|--compile
+                          | -p|--pgstart
+                          | -l|--link PROGRAM [-s|--simple] )
+
+ Run pywrapper-install with no arguments to display this user guide.  Exactly
+ one of -c/--compile, -p/--pgstart, or -l/--link must be given to perform an
+ action.
 
       - Option -u or --user USER
           The user name to own the setuid binary.  For Mode 1 (CommonUser program),
@@ -16,16 +23,22 @@
           Only needed when installing into an environment other than the one
           currently active.
 
+      - Option -c or --compile
+          Compile pywrapper.c (bundled with this package) and install it as
+          bin/pywrapper, owned by USER with chmod 4750 (setuid).  Must be done
+          once per environment before using -p/--pgstart or -l/--link.  Cannot
+          be combined with -p/--pgstart or -l/--link.
+
       - Option -p or --pgstart
           Mode 2: copy the compiled pywrapper binary to pgstart_USER (owned by USER,
           chmod 4750).  Allows USER to run arbitrary commands as themselves via the
-          setuid wrapper.  Cannot be combined with -l/--link.
+          setuid wrapper.  Cannot be combined with -c/--compile or -l/--link.
 
       - Option -l or --link PROGRAM
           Mode 1: create a symlink PROGRAM -> pywrapper in the bin/ directory, then
           lock down setuid_PROGRAM (chmod 700, owned by USER) so users cannot bypass
           the setuid wrapper by running setuid_PROGRAM directly.  Cannot be combined
-          with -p/--pgstart.
+          with -c/--compile or -p/--pgstart.
 
       - Option -s or --simple (use with -l/--link)
           Simple install: create a symlink PROGRAM -> setuid_PROGRAM directly,
@@ -33,11 +46,6 @@
           user with no privilege change.  -u/--user is not required with this option.
           Useful for users who do not need or cannot set up the setuid wrapper.
 
- When run without --pgstart or --link, the default action is to compile pywrapper.c
- (bundled with this package) and install it as bin/pywrapper, owned by USER with
- chmod 4750 (setuid).  This step must be done once per environment before using
- --pgstart or --link.
-
  Convention for wrapped programs:
    Any Python package whose program is to be run via pywrapper must:
 
@@ -99,7 +107,7 @@
          pip install rda_python_dsarch
 
    2. Compile pywrapper (once per environment):
-         pywrapper-install
+         pywrapper-install -c
 
    3. Wire up each program as a setuid entry:
          pywrapper-install -l dsarch
@@ -118,10 +126,10 @@
  Examples:
 
    1. Compile and install pywrapper for common user gdexdata (default):
-         pywrapper-install
+         pywrapper-install -c
 
    2. Same, but targeting a specific environment:
-         pywrapper-install -e /glade/u/home/gdexdata/gdexmsenv
+         pywrapper-install -c -e /glade/u/home/gdexdata/gdexmsenv
 
    3. Wire up dsarch to run as gdexdata via pywrapper:
          pywrapper-install -l dsarch

{rda_python_setuid-1.0.6 → rda_python_setuid-1.0.8}/src/rda_python_setuid/pywrapper.c

@@ -10,15 +10,15 @@
  *    python -m pip install rda_python_setuid
  *
  *    # Compile pywrapper and set setuid bit (owned by CommonUser):
- *    pywrapper-install [-u CommonUser] [-e $ENVHOME/bin]
+ *    pywrapper-install -c|--compile [-u|--user CommonUser] [-e|--envhome $ENVHOME]
  *
  *    # For an existing python program, $ENVHOME/bin/setuid_CommonProgram, to execute it
  *    # as the common user (Mode 1 - symlink):
- *    pywrapper-install -l CommonProgram [-u CommonUser] [-e $ENVHOME/bin]
+ *    pywrapper-install -l|--link CommonProgram [-u|--user CommonUser] [-e|--envhome $ENVHOME]
  *    CommonProgram [options]
  *
  *    # For a specialist to run commands as themselves via pgstart (Mode 2):
- *    pywrapper-install -p [-u EffectUser] [-e $ENVHOME/bin]
+ *    pywrapper-install -p|--pgstart [-u|--user EffectUser] [-e|--envhome $ENVHOME]
  *    pgstart_EffectUser EffectProgram [options]
  *
  *           N: python 3 release number, it is 10 for Python 3.10.12

{rda_python_setuid-1.0.6 → rda_python_setuid-1.0.8/src/rda_python_setuid.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 1.0.6
+Version: 1.0.8
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -30,6 +30,28 @@ Two modes are supported:
 - **Mode 2 (pgstart specialist):** a copy `pgstart_zji` runs any command as specialist
   `zji` via `pgstart.py`, restricted to authorized users.
 
+Two Python entry points are packaged alongside the C wrapper:
+
+- **`pywrapper.py`** — the default fallback target executed when `pywrapper.c`
+  cannot resolve a matching `setuid_<program>` entry point.  Acquires the
+  effective UID via `PgLOG.set_suid()`, prints the caller's real and effective
+  user names, and shows the `pyproject.toml` snippet plus the
+  `pywrapper-install -l <program>` command needed to wrap a new script.
+  Diagnostic flags `-env`, `-inc`, and `-plg` dump the environment variables,
+  `sys.path`, and `PGLOG` dictionary respectively — handy for verifying the
+  setuid environment before wiring up a real program.
+
+- **`pgstart.py`** — the Mode 2 launcher invoked through a `pgstart_<USER>`
+  copy of `pywrapper`.  Reads the real/effective UIDs from `PGLOG`, then
+  permits execution only if the real user matches the effective user or the
+  shared GDEX common user (`PGLOG['GDEXUSER']`); unauthorized callers receive
+  an informational message and exit.  After authorization it parses leading
+  flag tokens — `-bg` (background via `subprocess.Popen`), `-fg` (explicit
+  foreground, default), `-cwd <dir>` (chdir before exec), and the same
+  `-env`/`-inc`/`-plg` diagnostics as `pywrapper.py` — and then runs the
+  remaining arguments as a command (`subprocess.run`/`Popen`) under the
+  effective UID, logging a host/program/timestamp/user line to `pgstart.log`.
+
 ## Dependency requirement
 
 Any Python package whose programs are to be run via the setuid mechanism must declare
@@ -91,13 +113,13 @@ pywrapper-install
 pip install rda_python_dsarch
 
 # 2. Compile pywrapper C binary (once per environment):
-pywrapper-install
+pywrapper-install -c|--compile
 
 # 3. Wire up each program as a setuid entry:
-pywrapper-install -l dsarch
+pywrapper-install -l|--link dsarch
 
 # 4. Optionally, allow a specialist to run commands as themselves:
-pywrapper-install -p -u zji
+pywrapper-install -p|--pgstart -u|--user zji
 ```
 
 ### Simple install (no sudo required, runs as current user)
@@ -107,7 +129,7 @@ direct symlink from `dsarch` to `setuid_dsarch`:
 
 ```bash
 pip install rda_python_dsarch
-pywrapper-install -l dsarch -s
+pywrapper-install -l|--link dsarch -s|--simple
 ```
 
 ## Runtime flow