rda-python-setuid 1.0.9__tar.gz → 3.0.0__tar.gz

{rda_python_setuid-1.0.9/src/rda_python_setuid.egg-info → rda_python_setuid-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 1.0.9
+Version: 3.0.0
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -27,8 +27,10 @@ Two modes are supported:
 
 - **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
   as the common user.
-- **Mode 2 (pgstart specialist):** a copy `pgstart_zji` runs any command as specialist
-  `zji` via `pgstart.py`, restricted to authorized users.
+- **Mode 2 (pgstart specialist):** a copy `pgstart_<loginname>` (e.g. `pgstart_zji`)
+  runs any command as `<loginname>` via `pgstart.py`.  `<loginname>` can be any
+  user that belongs to the same group as `PGLOG['COMMONUSER']`.  Execution is
+  restricted to authorized callers (see `pgstart.py` below).
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -41,10 +43,12 @@ Two Python entry points are packaged alongside the C wrapper:
   `sys.path`, and `PGLOG` dictionary respectively — handy for verifying the
   setuid environment before wiring up a real program.
 
-- **`pgstart.py`** — the Mode 2 launcher invoked through a `pgstart_<USER>`
+- **`pgstart.py`** — the Mode 2 launcher invoked through a `pgstart_<loginname>`
   copy of `pywrapper`.  Reads the real/effective UIDs from `PGLOG`, then
-  permits execution only if the real user matches the effective user or the
-  shared GDEX common user (`PGLOG['GDEXUSER']`); unauthorized callers receive
+  permits execution only if the real user is in
+  `[PGLOG['ADMINUSER'], euser, PGLOG['COMMONUSER']]`
+  (i.e. the admin specialist `PGLOG['ADMINUSER']` — default `zji` — the
+  effective user themselves, or the shared common user); unauthorized callers receive
   an informational message and exit.  After authorization it parses leading
   flag tokens — `-bg` (background via `subprocess.Popen`), `-fg` (explicit
   foreground, default), `-cwd <dir>` (chdir before exec), and the same
@@ -78,30 +82,84 @@ automatically.  `pywrapper-install -l/--link` creates the symlink
 `dsarch -> pywrapper`; running `dsarch` goes through the setuid wrapper, which
 execs `setuid_dsarch` as CommonUser.
 
+The `main()` of each wrapped program (e.g. `rda_python_dsarch/dsarch.py`) must
+also call `show_setup_guide()` at the top of `main()`, passing an instance of
+the program's class along with the package name and list of setuid program
+names:
+
+```python
+def main():
+   from rda_python_setuid.setup_guide import show_setup_guide
+   object = DsArch()
+   show_setup_guide(object, 'rda_python_dsarch', ['dsarch'])
+   ...
+```
+
+When `setuid_dsarch` is invoked directly (before pywrapper symlinks are set
+up, so euid ≠ CommonUser), `show_setup_guide()` prints the shared setuid setup
+guide and exits.  When invoked via the `dsarch -> pywrapper` symlink (euid =
+CommonUser), `get_command()` strips the `setuid_` prefix, the check inside
+`show_setup_guide()` fails, and the program runs normally.
+
 ## Environment setup
 
+Create a Python environment first; package installs in the next section run
+inside whichever environment you activate here.
+
 ### Option A — Python venv (DECS machines)
 
 ```bash
 python3 -m venv $ENVHOME          # e.g. /glade/u/home/gdexdata/gdexmsenv
 source $ENVHOME/bin/activate
-pip install rda_python_setuid rda_python_dsarch ...
 ```
 
 ### Option B — Conda (DAV/Casper)
 
 ```bash
-conda create -n pg-gdex python=3.10
-conda activate pg-gdex
-pip install rda_python_setuid rda_python_dsarch ...
+conda create --prefix $ENVHOME python=3.12   # e.g. /glade/work/gdexdata/conda-envs/pg-gdex
+conda activate $ENVHOME
 ```
 
-The conda environment is typically at `/glade/work/gdexdata/conda-envs/pg-gdex`.
+## Installing rda-python-setuid
 
-## Installation
+Pick whichever install mode fits your workflow.  All four pull in the
+transitive dependency (`rda_python_common`) automatically.  Once installed,
+the `pywrapper-install` CLI is available for the setuid wiring steps below.
 
-After setting up the environment and installing packages, run `pywrapper-install`
-with no arguments to display the full user guide:
+For local development, clone this repo alongside your project and install it
+in editable mode so that changes are picked up without re-installing:
+
+```bash
+git clone https://github.com/NCAR/rda-python-setuid.git
+cd rda-python-setuid
+pip install -e .
+```
+
+To test a specific branch (e.g. an in-progress feature or fix branch), pass
+`-b/--branch` to `git clone`:
+
+```bash
+git clone -b <branch-name> https://github.com/NCAR/rda-python-setuid.git
+cd rda-python-setuid
+pip install -e .
+```
+
+For a regular (non-editable) install from a checkout:
+
+```bash
+pip install /path/to/rda-python-setuid
+```
+
+For a production install on a system that uses the published distribution:
+
+```bash
+pip install rda_python_setuid
+```
+
+## Setuid wrapper setup
+
+With `rda_python_setuid` installed in the active environment, run
+`pywrapper-install` with no arguments to display the full user guide:
 
 ```bash
 pywrapper-install
@@ -116,11 +174,32 @@ pip install rda_python_dsarch
 # 2. Compile pywrapper C binary (once per environment):
 pywrapper-install -c|--compile
 
-# 3. Wire up each program as a setuid entry:
+# 3. Wire up each program as a setuid entry (specify name or use 'all'):
 pywrapper-install -l|--link dsarch
+pywrapper-install -l|--link all           # auto-link every setuid_* entry not yet linked
+
+# 4. Optionally, install a pgstart_<loginname> binary so <loginname> (any user
+#    in the same group as PGLOG['COMMONUSER']) can run commands as themselves
+#    via the setuid wrapper.  Same command in both cases — only the invoker
+#    differs:
+#
+#    4a. If PGLOG['ADMINUSER'] (default zji) can `sudo -u <loginname>`, the
+#        admin sets it up on the user's behalf:
+pywrapper-install -p|--pgstart -n|--username <loginname>
+#
+#    4b. Otherwise <loginname> runs the same command themselves (no sudo
+#        from ADMINUSER required, since they already are <loginname>):
+pywrapper-install -p|--pgstart -n|--username <loginname>
+```
 
-# 4. Optionally, allow a specialist to run commands as themselves:
-pywrapper-install -p|--pgstart -u|--user zji
+### Update an existing installation (no sudo required)
+
+When the package is upgraded and a new `pywrapper.c` is bundled, use `-u/--update`
+to recompile and reinstall all setuid binaries without needing `sudo`.  The existing
+`pgstart_*` binaries in `bin/` are used to perform the privileged operations:
+
+```bash
+pywrapper-install -u|--update [-n|--username gdexdata] [-e|--envhome $ENVHOME]
 ```
 
 ### Simple install (no sudo required, runs as current user)
@@ -131,6 +210,7 @@ direct symlink from `dsarch` to `setuid_dsarch`:
 ```bash
 pip install rda_python_dsarch
 pywrapper-install -l|--link dsarch -s|--simple
+pywrapper-install -l|--link all -s|--simple   # or link all setuid_* entries at once
 ```
 
 ## Runtime flow

rda_python_setuid-3.0.0/README.md

@@ -0,0 +1,211 @@
+RDA Python package, including a C code wrapper, to execute commandline applications
+via setuid for effective and common user names.
+
+## Overview
+
+`rda_python_setuid` provides a C binary (`pywrapper`) that acquires a setuid effective
+user, then `execv`s a Python entry point script.  This allows Python programs to run
+as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
+
+Two modes are supported:
+
+- **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
+  as the common user.
+- **Mode 2 (pgstart specialist):** a copy `pgstart_<loginname>` (e.g. `pgstart_zji`)
+  runs any command as `<loginname>` via `pgstart.py`.  `<loginname>` can be any
+  user that belongs to the same group as `PGLOG['COMMONUSER']`.  Execution is
+  restricted to authorized callers (see `pgstart.py` below).
+
+Two Python entry points are packaged alongside the C wrapper:
+
+- **`pywrapper.py`** — the default fallback target executed when `pywrapper.c`
+  cannot resolve a matching `setuid_<program>` entry point.  Acquires the
+  effective UID via `PgLOG.set_suid()`, prints the caller's real and effective
+  user names, and shows the `pyproject.toml` snippet plus the
+  `pywrapper-install -l <program>` command needed to wrap a new script.
+  Diagnostic flags `-env`, `-inc`, and `-plg` dump the environment variables,
+  `sys.path`, and `PGLOG` dictionary respectively — handy for verifying the
+  setuid environment before wiring up a real program.
+
+- **`pgstart.py`** — the Mode 2 launcher invoked through a `pgstart_<loginname>`
+  copy of `pywrapper`.  Reads the real/effective UIDs from `PGLOG`, then
+  permits execution only if the real user is in
+  `[PGLOG['ADMINUSER'], euser, PGLOG['COMMONUSER']]`
+  (i.e. the admin specialist `PGLOG['ADMINUSER']` — default `zji` — the
+  effective user themselves, or the shared common user); unauthorized callers receive
+  an informational message and exit.  After authorization it parses leading
+  flag tokens — `-bg` (background via `subprocess.Popen`), `-fg` (explicit
+  foreground, default), `-cwd <dir>` (chdir before exec), and the same
+  `-env`/`-inc`/`-plg` diagnostics as `pywrapper.py` — and then runs the
+  remaining arguments as a command (`subprocess.run`/`Popen`) under the
+  effective UID, logging a host/program/timestamp/user line to `pgstart.log`.
+
+## Dependency requirement
+
+Any Python package whose programs are to be run via the setuid mechanism must declare
+`rda_python_setuid` as a dependency in its `pyproject.toml`:
+
+```toml
+[project]
+dependencies = [
+  "rda_python_setuid",
+  ...
+]
+```
+
+It must also register each wrapped program's connector entry point with a `setuid_`
+prefix:
+
+```toml
+[project.scripts]
+"setuid_dsarch" = "rda_python_dsarch.dsarch:main"
+```
+
+`pip install` then places `setuid_dsarch` in the environment's `bin/` directory
+automatically.  `pywrapper-install -l/--link` creates the symlink
+`dsarch -> pywrapper`; running `dsarch` goes through the setuid wrapper, which
+execs `setuid_dsarch` as CommonUser.
+
+The `main()` of each wrapped program (e.g. `rda_python_dsarch/dsarch.py`) must
+also call `show_setup_guide()` at the top of `main()`, passing an instance of
+the program's class along with the package name and list of setuid program
+names:
+
+```python
+def main():
+   from rda_python_setuid.setup_guide import show_setup_guide
+   object = DsArch()
+   show_setup_guide(object, 'rda_python_dsarch', ['dsarch'])
+   ...
+```
+
+When `setuid_dsarch` is invoked directly (before pywrapper symlinks are set
+up, so euid ≠ CommonUser), `show_setup_guide()` prints the shared setuid setup
+guide and exits.  When invoked via the `dsarch -> pywrapper` symlink (euid =
+CommonUser), `get_command()` strips the `setuid_` prefix, the check inside
+`show_setup_guide()` fails, and the program runs normally.
+
+## Environment setup
+
+Create a Python environment first; package installs in the next section run
+inside whichever environment you activate here.
+
+### Option A — Python venv (DECS machines)
+
+```bash
+python3 -m venv $ENVHOME          # e.g. /glade/u/home/gdexdata/gdexmsenv
+source $ENVHOME/bin/activate
+```
+
+### Option B — Conda (DAV/Casper)
+
+```bash
+conda create --prefix $ENVHOME python=3.12   # e.g. /glade/work/gdexdata/conda-envs/pg-gdex
+conda activate $ENVHOME
+```
+
+## Installing rda-python-setuid
+
+Pick whichever install mode fits your workflow.  All four pull in the
+transitive dependency (`rda_python_common`) automatically.  Once installed,
+the `pywrapper-install` CLI is available for the setuid wiring steps below.
+
+For local development, clone this repo alongside your project and install it
+in editable mode so that changes are picked up without re-installing:
+
+```bash
+git clone https://github.com/NCAR/rda-python-setuid.git
+cd rda-python-setuid
+pip install -e .
+```
+
+To test a specific branch (e.g. an in-progress feature or fix branch), pass
+`-b/--branch` to `git clone`:
+
+```bash
+git clone -b <branch-name> https://github.com/NCAR/rda-python-setuid.git
+cd rda-python-setuid
+pip install -e .
+```
+
+For a regular (non-editable) install from a checkout:
+
+```bash
+pip install /path/to/rda-python-setuid
+```
+
+For a production install on a system that uses the published distribution:
+
+```bash
+pip install rda_python_setuid
+```
+
+## Setuid wrapper setup
+
+With `rda_python_setuid` installed in the active environment, run
+`pywrapper-install` with no arguments to display the full user guide:
+
+```bash
+pywrapper-install
+```
+
+### Full setuid setup (requires sudo access to CommonUser)
+
+```bash
+# 1. Install the target package (pulls in rda_python_setuid automatically):
+pip install rda_python_dsarch
+
+# 2. Compile pywrapper C binary (once per environment):
+pywrapper-install -c|--compile
+
+# 3. Wire up each program as a setuid entry (specify name or use 'all'):
+pywrapper-install -l|--link dsarch
+pywrapper-install -l|--link all           # auto-link every setuid_* entry not yet linked
+
+# 4. Optionally, install a pgstart_<loginname> binary so <loginname> (any user
+#    in the same group as PGLOG['COMMONUSER']) can run commands as themselves
+#    via the setuid wrapper.  Same command in both cases — only the invoker
+#    differs:
+#
+#    4a. If PGLOG['ADMINUSER'] (default zji) can `sudo -u <loginname>`, the
+#        admin sets it up on the user's behalf:
+pywrapper-install -p|--pgstart -n|--username <loginname>
+#
+#    4b. Otherwise <loginname> runs the same command themselves (no sudo
+#        from ADMINUSER required, since they already are <loginname>):
+pywrapper-install -p|--pgstart -n|--username <loginname>
+```
+
+### Update an existing installation (no sudo required)
+
+When the package is upgraded and a new `pywrapper.c` is bundled, use `-u/--update`
+to recompile and reinstall all setuid binaries without needing `sudo`.  The existing
+`pgstart_*` binaries in `bin/` are used to perform the privileged operations:
+
+```bash
+pywrapper-install -u|--update [-n|--username gdexdata] [-e|--envhome $ENVHOME]
+```
+
+### Simple install (no sudo required, runs as current user)
+
+Users who do not need the setuid mechanism can skip steps 2–4 and create a
+direct symlink from `dsarch` to `setuid_dsarch`:
+
+```bash
+pip install rda_python_dsarch
+pywrapper-install -l|--link dsarch -s|--simple
+pywrapper-install -l|--link all -s|--simple   # or link all setuid_* entries at once
+```
+
+## Runtime flow
+
+```
+user runs:  dsarch [args]
+              |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
+pywrapper.c:  execv(bin/setuid_dsarch, args)
+setuid_dsarch: calls dsarch:main() as gdexdata
+```
+
+## Github
+
+<https://github.com/NCAR/rda-python-setuid>

{rda_python_setuid-1.0.9 → rda_python_setuid-3.0.0}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rda_python_setuid"
-version = "1.0.9"
+version = "3.0.0"
 authors = [
   { name="Zaihua Ji", email="zji@ucar.edu" },
 ]
@@ -30,7 +30,7 @@ include-package-data = true
 where = ["src"]
 
 [tool.setuptools.package-data]
-"rda_python_setuid" = ["pywrapper.c", "install.usg"]
+"rda_python_setuid" = ["pywrapper.c", "install.usg", "setuid_setup.usg"]
 
 [project.urls]
 "Homepage" = "https://github.com/NCAR/rda-python-setuid"

rda_python_setuid-3.0.0/src/rda_python_setuid/install.py

@@ -0,0 +1,286 @@
+#!/usr/bin/env python3
+#
+##################################################################################
+#
+#     Title: pywrapper-install
+#    Author: Zaihua Ji, zji@ucar.edu
+#      Date: 2025-05-11
+#   Purpose: Install helper for the pywrapper setuid C binary.
+#            Replaces the manual gcc/chmod/ln steps with a single command.
+#
+#    Github: https://github.com/NCAR/rda-python-setuid.git
+#
+# Usage:
+#   # 0. Display this user guide:
+#   pywrapper-install
+#
+#   # 1. Compile and install pywrapper (run once per environment):
+#   pywrapper-install -c [-n gdexdata] [-e $ENVHOME]
+#
+#   # 2. Create pgstart_USER entry so USER can run commands as themselves:
+#   pywrapper-install -p [-n zji] [-e $ENVHOME]
+#
+#   # 3. Create a symlink so a program runs as CommonUser via pywrapper (setuid):
+#   pywrapper-install -l myprog [-n gdexdata] [-e $ENVHOME]
+#
+#   # 3b. Auto-link all discovered setuid_* entries that are not yet linked:
+#   pywrapper-install -l all [-e $ENVHOME]
+#
+#   # 4. Simple install: symlink PROGRAM -> setuid_PROGRAM (no setuid, runs as current user):
+#   pywrapper-install -l myprog -s [-e $ENVHOME]
+#
+#   # 5. Update existing installation (recompile and reinstall all setuid binaries):
+#   pywrapper-install -u [-n gdexdata] [-e $ENVHOME]
+#
+# Convention for wrapped programs:
+#   The target package must register its connector entry point with a setuid_ prefix:
+#      [project.scripts]
+#      "setuid_dsarch" = "rda_python_dsarch.dsarch:main"
+#   pip install places setuid_dsarch in the bin dir automatically.
+#   pywrapper-install --link dsarch creates the symlink dsarch -> pywrapper, so
+#   users invoking dsarch go through the setuid wrapper which execs setuid_dsarch
+#   as CommonUser.
+#   pywrapper-install --link dsarch --simple creates dsarch -> setuid_dsarch directly,
+#   skipping setuid; the program runs as the current user.
+#
+##################################################################################
+
+import argparse
+import os
+import shutil
+import subprocess
+import sys
+
+
+def get_bindir():
+   """Return the bin directory of the active Python environment."""
+   return os.path.dirname(os.path.abspath(sys.executable))
+
+
+def get_c_source():
+   """Return path to pywrapper.c bundled with this package."""
+   return os.path.join(os.path.dirname(__file__), 'pywrapper.c')
+
+
+def run(cmd):
+   print("  $", " ".join(cmd))
+   subprocess.run(cmd, check=True)
+
+
+def show_usage():
+   usgfile = os.path.join(os.path.dirname(__file__), 'install.usg')
+   os.system("more " + usgfile)
+   sys.exit(0)
+
+
+def main():
+
+   parser = argparse.ArgumentParser(
+      description="Compile and install the pywrapper setuid C binary."
+   )
+   parser.add_argument(
+      '-e', '--envhome', default=None,
+      help="Path to the venv root directory containing bin/ (default: parent of the current Python executable's bin/ dir)"
+   )
+   parser.add_argument(
+      '-n', '--username', default=None,
+      help="User name to own the setuid binary (default: current login user for -p/--pgstart, gdexdata otherwise)"
+   )
+   parser.add_argument(
+      '-s', '--simple', action='store_true',
+      help="Simple install: create symlink PROGRAM -> setuid_PROGRAM, skipping setuid (use with -l/--link)"
+   )
+   group = parser.add_mutually_exclusive_group()
+   group.add_argument(
+      '-c', '--compile', action='store_true',
+      help="Compile pywrapper.c and install bin/pywrapper as a setuid binary (run once per environment)"
+   )
+   group.add_argument(
+      '-p', '--pgstart', action='store_true',
+      help="Create pgstart_USER for running commands as USER (Mode 2)"
+   )
+   group.add_argument(
+      '-l', '--link', metavar='PROGRAM',
+      help="Create symlink PROGRAM -> pywrapper for running a fixed program as CommonUser (Mode 1); use 'all' to auto-link every setuid_* entry not yet linked"
+   )
+   group.add_argument(
+      '-u', '--update', action='store_true',
+      help="Update an existing installation: recompile pywrapper and reinstall all pgstart_USER setuid binaries"
+   )
+   args = parser.parse_args()
+
+   if not (args.compile or args.pgstart or args.link or args.update):
+      show_usage()
+
+   if args.username is None and not args.simple:
+      import pwd
+      if args.pgstart:
+         args.username = pwd.getpwuid(os.getuid()).pw_name
+      else:
+         args.username = 'gdexdata'
+
+   bindir = os.path.join(args.envhome, 'bin') if args.envhome else get_bindir()
+   pywrapper = os.path.join(bindir, 'pywrapper')
+
+   if args.link:
+      # For appname -> pywrapper links, run `ln -s` via pgstart_<commonuser> so
+      # the resulting symlink is owned by the common user (pywrapper owner).
+      pgstart_common = None
+      if not args.simple and os.path.exists(pywrapper):
+         import pwd
+         common_user = pwd.getpwuid(os.stat(pywrapper).st_uid).pw_name
+         pgstart_common = os.path.join(bindir, 'pgstart_' + common_user)
+         if not os.path.exists(pgstart_common):
+            print("Error: {} not found. Run pywrapper-install --pgstart --username {} first.".format(pgstart_common, common_user))
+            sys.exit(1)
+
+      if args.link.lower() == 'all':
+         # Discover all setuid_* entries in bindir and link any that are missing
+         appnames = sorted(
+            f[len('setuid_'):] for f in os.listdir(bindir) if f.startswith('setuid_')
+         )
+         if not appnames:
+            print("No setuid_* entries found in {}".format(bindir))
+         for appname in appnames:
+            target = os.path.join(bindir, appname)
+            script = os.path.join(bindir, 'setuid_' + appname)
+            if args.simple:
+               if os.path.lexists(target):
+                  print("Already exists: {}".format(target))
+               else:
+                  os.symlink(script, target)
+                  print("Created: {} -> setuid_{}".format(target, appname))
+            else:
+               if os.path.lexists(target):
+                  print("Already exists: {}".format(target))
+               else:
+                  run([pgstart_common, 'ln', '-s', pywrapper, target])
+                  print("Created: {} -> pywrapper".format(target))
+      else:
+         target = os.path.join(bindir, args.link)
+         script = os.path.join(bindir, 'setuid_{}'.format(args.link))
+         if not os.path.exists(script):
+            print("Error: {} not found. Install the package that provides it first.".format(script))
+            sys.exit(1)
+         if args.simple:
+            # Simple install: symlink PROGRAM -> setuid_PROGRAM, no setuid, runs as current user.
+            if os.path.lexists(target):
+               print("Already exists: {}".format(target))
+            else:
+               os.symlink(script, target)
+               print("Created: {} -> setuid_{}".format(target, args.link))
+         else:
+            # Mode 1: symlink PROGRAM -> pywrapper. setuid_PROGRAM is left with its
+            # default ownership/permissions so it can be loaded and executed normally.
+            if os.path.lexists(target):
+               print("Already exists: {}".format(target))
+            else:
+               run([pgstart_common, 'ln', '-s', pywrapper, target])
+               print("Created: {} -> pywrapper".format(target))
+
+   elif args.pgstart:
+      # Mode 2: create pgstart_USER with setuid owned by USER.
+      # When USER already owns pywrapper (i.e. the common user), pywrapper is
+      # already setuid owned by USER, so a symlink is sufficient; otherwise
+      # copy pywrapper and chmod 4750 as USER.
+      if not os.path.exists(pywrapper):
+         print("Error: {} not found. Run pywrapper-install --compile --username COMMONUSER first.".format(pywrapper))
+         sys.exit(1)
+      target = os.path.join(bindir, 'pgstart_{}'.format(args.username))
+      import pwd
+      pywrapper_owner = pwd.getpwuid(os.stat(pywrapper).st_uid).pw_name
+      if args.username == pywrapper_owner:
+         if os.path.lexists(target):
+            os.remove(target)
+         os.symlink(pywrapper, target)
+         print("Linked: {} -> pywrapper (setuid, owned by {})".format(target, args.username))
+      else:
+         curuser = pwd.getpwuid(os.getuid()).pw_name
+         sudo_prefix = [] if curuser == args.username else ['sudo', '-u', args.username]
+         run(sudo_prefix + ['cp', pywrapper, target])
+         run(sudo_prefix + ['chmod', '4750', target])
+         print("Installed: {} (setuid, owned by {})".format(target, args.username))
+
+   elif args.compile:
+      # Compile pywrapper.c and install pywrapper with setuid
+      src = get_c_source()
+      src_dest = os.path.join(bindir, 'pywrapper.c')
+      shutil.copy(src, src_dest)
+      print("Copied: {}".format(src_dest))
+      run(['sudo', '-u', args.username, 'gcc', '-o', pywrapper, src_dest])
+      run(['sudo', '-u', args.username, 'chmod', '4750', pywrapper])
+      print("Installed: {} (setuid, owned by {})".format(pywrapper, args.username))
+
+   elif args.update:
+      # Update an existing installation: recompile pywrapper and reinstall all setuid binaries
+      pgstart_files = sorted(f for f in os.listdir(bindir) if f.startswith('pgstart_'))
+      if not pgstart_files:
+         print("Error: No pgstart_* binaries found in {}".format(bindir))
+         sys.exit(1)
+      if not os.path.exists(pywrapper):
+         print("Error: {} not found.".format(pywrapper))
+         sys.exit(1)
+
+      gdexuser = args.username
+      pgstart_gdexdata = os.path.join(bindir, 'pgstart_' + gdexuser)
+      if not os.path.exists(pgstart_gdexdata):
+         print("Error: {} not found.".format(pgstart_gdexdata))
+         sys.exit(1)
+
+      update_tmp = os.path.join(bindir, 'update_tmp')
+      os.makedirs(update_tmp, exist_ok=True)
+      print("Created: {}".format(update_tmp))
+
+      # Symlink pgstart.py into update_tmp so pywrapper instances running from
+      # update_tmp can find it via the fpath/pgstart.py fallback lookup.
+      bindir_pgstart_py = os.path.join(bindir, 'pgstart.py')
+      update_pgstart_py = os.path.join(update_tmp, 'pgstart.py')
+      if not os.path.lexists(update_pgstart_py):
+         os.symlink(bindir_pgstart_py, update_pgstart_py)
+         print("Linked: {} -> {}".format(update_pgstart_py, bindir_pgstart_py))
+
+      # Copy each non-gdex pgstart_USERNAME into update_tmp using itself, then chmod 4750
+      for fname in pgstart_files:
+         username = fname[len('pgstart_'):]
+         if username == gdexuser:
+            continue
+         src_pgstart = os.path.join(bindir, fname)
+         dst_pgstart = os.path.join(update_tmp, fname)
+         run([src_pgstart, 'cp', src_pgstart, update_tmp + '/'])
+         run([src_pgstart, 'chmod', '4750', dst_pgstart])
+
+      # Copy pywrapper into update_tmp as gdexdata, chmod, then hardlink as pgstart_gdexdata
+      update_pywrapper = os.path.join(update_tmp, 'pywrapper')
+      update_pgstart_gdexdata = os.path.join(update_tmp, 'pgstart_' + gdexuser)
+      run([pgstart_gdexdata, 'cp', pywrapper, update_tmp + '/'])
+      run([pgstart_gdexdata, 'chmod', '4750', update_pywrapper])
+      run([pgstart_gdexdata, 'ln', update_pywrapper, update_pgstart_gdexdata])
+
+      # Compile new pywrapper using update_tmp/pgstart_gdexdata
+      src = get_c_source()
+      src_dest = os.path.join(bindir, 'pywrapper.c')
+      shutil.copy(src, src_dest)
+      print("Copied: {}".format(src_dest))
+      run([update_pgstart_gdexdata, 'gcc', '-o', pywrapper, src_dest])
+      run([update_pgstart_gdexdata, 'chmod', '4750', pywrapper])
+      print("Compiled: {} (setuid, owned by {})".format(pywrapper, gdexuser))
+
+      # Recreate each pgstart_* in bindir using the corresponding update_tmp/pgstart_*
+      for fname in sorted(f for f in os.listdir(update_tmp) if f.startswith('pgstart_')):
+         username = fname[len('pgstart_'):]
+         update_pgstart = os.path.join(update_tmp, fname)
+         target = os.path.join(bindir, fname)
+         if username == gdexuser:
+            run([update_pgstart_gdexdata, 'ln', '-sf', pywrapper, target])
+            print("Linked: {} -> pywrapper (setuid, owned by {})".format(target, gdexuser))
+         else:
+            run([update_pgstart, 'cp', pywrapper, target])
+            run([update_pgstart, 'chmod', '4750', target])
+            print("Updated: {} (setuid, owned by {})".format(target, username))
+
+      # Clean up the temporary working directory
+      shutil.rmtree(update_tmp)
+      print("Removed: {}".format(update_tmp))
+
+
+if __name__ == '__main__': main()