rda-python-setuid 1.0.8__tar.gz → 1.0.9__tar.gz

{rda_python_setuid-1.0.8/src/rda_python_setuid.egg-info → rda_python_setuid-1.0.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 1.0.8
+Version: 1.0.9
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -74,8 +74,9 @@ prefix:
 ```
 
 `pip install` then places `setuid_dsarch` in the environment's `bin/` directory
-automatically.  `pywrapper-install -l/--link` locks it down to `chmod 700` so users
-cannot bypass the setuid wrapper by running it directly.
+automatically.  `pywrapper-install -l/--link` creates the symlink
+`dsarch -> pywrapper`; running `dsarch` goes through the setuid wrapper, which
+execs `setuid_dsarch` as CommonUser.
 
 ## Environment setup
 
@@ -138,7 +139,6 @@ pywrapper-install -l|--link dsarch -s|--simple
 user runs:  dsarch [args]
               |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
 pywrapper.c:  execv(bin/setuid_dsarch, args)
-              |  (chmod 700, only gdexdata can exec directly)
 setuid_dsarch: calls dsarch:main() as gdexdata
 ```
 

{rda_python_setuid-1.0.8 → rda_python_setuid-1.0.9}/README.md

@@ -58,8 +58,9 @@ prefix:
 ```
 
 `pip install` then places `setuid_dsarch` in the environment's `bin/` directory
-automatically.  `pywrapper-install -l/--link` locks it down to `chmod 700` so users
-cannot bypass the setuid wrapper by running it directly.
+automatically.  `pywrapper-install -l/--link` creates the symlink
+`dsarch -> pywrapper`; running `dsarch` goes through the setuid wrapper, which
+execs `setuid_dsarch` as CommonUser.
 
 ## Environment setup
 
@@ -122,7 +123,6 @@ pywrapper-install -l|--link dsarch -s|--simple
 user runs:  dsarch [args]
               |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
 pywrapper.c:  execv(bin/setuid_dsarch, args)
-              |  (chmod 700, only gdexdata can exec directly)
 setuid_dsarch: calls dsarch:main() as gdexdata
 ```
 

{rda_python_setuid-1.0.8 → rda_python_setuid-1.0.9}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rda_python_setuid"
-version = "1.0.8"
+version = "1.0.9"
 authors = [
   { name="Zaihua Ji", email="zji@ucar.edu" },
 ]

{rda_python_setuid-1.0.8 → rda_python_setuid-1.0.9}/src/rda_python_setuid/install.py

@@ -31,8 +31,9 @@
 #      [project.scripts]
 #      "setuid_dsarch" = "rda_python_dsarch.dsarch:main"
 #   pip install places setuid_dsarch in the bin dir automatically.
-#   pywrapper-install --link dsarch will chown setuid_dsarch to CommonUser and
-#   chmod 700, so users cannot run it directly and must go through the setuid wrapper.
+#   pywrapper-install --link dsarch creates the symlink dsarch -> pywrapper, so
+#   users invoking dsarch go through the setuid wrapper which execs setuid_dsarch
+#   as CommonUser.
 #   pywrapper-install --link dsarch --simple creates dsarch -> setuid_dsarch directly,
 #   skipping setuid; the program runs as the current user.
 #
@@ -125,19 +126,13 @@ def main():
             os.symlink(script, target)
             print("Created: {} -> setuid_{}".format(target, args.link))
       else:
-         # Mode 1: symlink PROGRAM -> pywrapper, then lock down setuid_PROGRAM
-         # so users cannot bypass the setuid wrapper by running it directly.
+         # Mode 1: symlink PROGRAM -> pywrapper. setuid_PROGRAM is left with its
+         # default ownership/permissions so it can be loaded and executed normally.
          if os.path.lexists(target):
             print("Already exists: {}".format(target))
          else:
             os.symlink(pywrapper, target)
             print("Created: {} -> pywrapper".format(target))
-         # chown and chmod 700: only CommonUser can execute setuid_PROGRAM directly.
-         # pywrapper (running as CommonUser via setuid) can still execv it, but any
-         # direct invocation by other users will get "permission denied".
-         run(['sudo', '-u', args.user, 'chown', args.user, script])
-         run(['sudo', '-u', args.user, 'chmod', '700', script])
-         print("Locked: {} (chmod 700, owned by {})".format(script, args.user))
 
    elif args.pgstart:
       # Mode 2: copy pywrapper to pgstart_USER with setuid owned by USER
@@ -145,8 +140,11 @@ def main():
          print("Error: {} not found. Run pywrapper-install --user COMMONUSER first.".format(pywrapper))
          sys.exit(1)
       target = os.path.join(bindir, 'pgstart_{}'.format(args.user))
-      run(['sudo', '-u', args.user, 'cp', pywrapper, target])
-      run(['sudo', '-u', args.user, 'chmod', '4750', target])
+      import pwd
+      curuser = pwd.getpwuid(os.getuid()).pw_name
+      sudo_prefix = [] if curuser == args.user else ['sudo', '-u', args.user]
+      run(sudo_prefix + ['cp', pywrapper, target])
+      run(sudo_prefix + ['chmod', '4750', target])
       print("Installed: {} (setuid, owned by {})".format(target, args.user))
 
    elif args.compile:

{rda_python_setuid-1.0.8 → rda_python_setuid-1.0.9}/src/rda_python_setuid/install.usg

@@ -35,10 +35,11 @@
           setuid wrapper.  Cannot be combined with -c/--compile or -l/--link.
 
       - Option -l or --link PROGRAM
-          Mode 1: create a symlink PROGRAM -> pywrapper in the bin/ directory, then
-          lock down setuid_PROGRAM (chmod 700, owned by USER) so users cannot bypass
-          the setuid wrapper by running setuid_PROGRAM directly.  Cannot be combined
-          with -c/--compile or -p/--pgstart.
+          Mode 1: create a symlink PROGRAM -> pywrapper in the bin/ directory so
+          that running PROGRAM invokes the setuid wrapper, which then execs
+          setuid_PROGRAM as CommonUser.  setuid_PROGRAM keeps its default
+          ownership and permissions.  Cannot be combined with -c/--compile or
+          -p/--pgstart.
 
       - Option -s or --simple (use with -l/--link)
           Simple install: create a symlink PROGRAM -> setuid_PROGRAM directly,
@@ -66,8 +67,8 @@
          "setuid_dsarch" = "rda_python_dsarch.dsarch:main"
 
       pip install then places setuid_dsarch in the bin/ directory automatically.
-      Running pywrapper-install --link will lock it down (chmod 700) so that only
-      pywrapper (running as CommonUser via its setuid bit) can execv it.
+      Running pywrapper-install --link creates the symlink dsarch -> pywrapper;
+      pywrapper (running as CommonUser via its setuid bit) execs setuid_dsarch.
 
  Environment Setup:
 

{rda_python_setuid-1.0.8 → rda_python_setuid-1.0.9}/src/rda_python_setuid/pgstart.py

@@ -49,7 +49,7 @@ def main():
    euid = pglog.PGLOG['EUID']
    ruser = pwd.getpwuid(ruid).pw_name
    euser = pwd.getpwuid(euid).pw_name
-   if ruser == euser or ruser == pglog.PGLOG['GDEXUSER']: permit = True
+   if ruser == euser or ruser == pglog.PGLOG['GDEXUSER'] or euser == pglog.PGLOG['GDEXUSER']: permit = True
    pglog.set_suid(euid)
 
    while argv:

{rda_python_setuid-1.0.8 → rda_python_setuid-1.0.9/src/rda_python_setuid.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 1.0.8
+Version: 1.0.9
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -74,8 +74,9 @@ prefix:
 ```
 
 `pip install` then places `setuid_dsarch` in the environment's `bin/` directory
-automatically.  `pywrapper-install -l/--link` locks it down to `chmod 700` so users
-cannot bypass the setuid wrapper by running it directly.
+automatically.  `pywrapper-install -l/--link` creates the symlink
+`dsarch -> pywrapper`; running `dsarch` goes through the setuid wrapper, which
+execs `setuid_dsarch` as CommonUser.
 
 ## Environment setup
 
@@ -138,7 +139,6 @@ pywrapper-install -l|--link dsarch -s|--simple
 user runs:  dsarch [args]
               |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
 pywrapper.c:  execv(bin/setuid_dsarch, args)
-              |  (chmod 700, only gdexdata can exec directly)
 setuid_dsarch: calls dsarch:main() as gdexdata
 ```