rda-python-setuid 3.0.0__tar.gz → 3.0.1__tar.gz

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.1}/MANIFEST.in

@@ -1,2 +1,3 @@
 include src/rda_python_setuid/pywrapper.c
+include src/rda_python_setuid/cmwrapper.c
 include src/rda_python_setuid/install.usg

{rda_python_setuid-3.0.0/src/rda_python_setuid.egg-info → rda_python_setuid-3.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 3.0.0
+Version: 3.0.1
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -23,7 +23,7 @@ via setuid for effective and common user names.
 user, then `execv`s a Python entry point script.  This allows Python programs to run
 as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
 
-Two modes are supported:
+Three modes are supported:
 
 - **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
   as the common user.
@@ -31,6 +31,10 @@ Two modes are supported:
   runs any command as `<loginname>` via `pgstart.py`.  `<loginname>` can be any
   user that belongs to the same group as `PGLOG['COMMONUSER']`.  Execution is
   restricted to authorized callers (see `pgstart.py` below).
+- **Mode 3 (cmwrapper, callers outside the group):** a dedicated binary compiled
+  from `cmwrapper.c` and installed `4755` runs ONE fixed program as the common
+  user for any user on the machine, including users outside the common user's
+  group (see "cmwrapper" below).
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -213,6 +217,45 @@ pywrapper-install -l|--link dsarch -s|--simple
 pywrapper-install -l|--link all -s|--simple   # or link all setuid_* entries at once
 ```
 
+### cmwrapper (Mode 3, for callers outside the CommonUser group)
+
+`pywrapper` is installed `4750`, so only members of the common user's group can
+execute it.  That group restriction is what makes it safe for `pywrapper` to pick
+the program to run from `basename(argv[0])`: anyone who can execute it can already
+reach every `setuid_*` entry in `bin/` just by naming the symlink differently.
+
+`cmwrapper` is for the opposite case — letting users who are **not** in the common
+user's group run one specific program as the common user.  It is installed `4755`,
+i.e. executable by everyone, so nothing about what it runs may come from the caller:
+
+- the absolute path of the script to exec, and the program name, are baked into the
+  binary at compile time, so it cannot be symlinked under another name to reach a
+  different program;
+- the environment is replaced with a fixed whitelist (`HOME`, `USER`, `LOGNAME`,
+  `TERM`, `LANG`, `TZ`, a fixed `PATH` and `PYTHONNOUSERSITE=1`), so `PYTHONPATH`,
+  `PYTHONHOME`, `LD_PRELOAD`, `LD_LIBRARY_PATH` and the `PGLOG` path variables
+  (`DSDHOME`, `DSSHOME`, `LOGPATH`, `COMMONUSER`, ...) cannot be used to run
+  arbitrary code, or redirect where files are written, as the common user.
+
+One binary is compiled per wrapped program:
+
+```bash
+# Install bin/gdexdrop as a 4755 binary that execs bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop
+
+# Same, but installed into a common area already on everyone's PATH:
+pywrapper-install -m|--cmlink gdexdrop -d|--destdir /glade/u/home/gdexdata/bin
+
+# Point it at a script somewhere other than bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop -t|--target /path/to/setuid_gdexdrop
+```
+
+Only wrap a program that does its own authorization and confines where it writes,
+such as `gdexdrop`, which checks its caller against an access list and copies only
+into the requested dataset directory.  Never wrap a general purpose program such as
+`gdexcp`: at `4755` that would let any user on the machine read or overwrite any
+file of the common user.
+
 ## Runtime flow
 
 ```
@@ -220,6 +263,11 @@ user runs:  dsarch [args]
               |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
 pywrapper.c:  execv(bin/setuid_dsarch, args)
 setuid_dsarch: calls dsarch:main() as gdexdata
+
+user runs:  gdexdrop [args]
+              |  (dedicated 4755 binary, setuid bit -> EUID=gdexdata)
+cmwrapper.c:  execve(bin/setuid_gdexdrop, args, sanitized env)
+setuid_gdexdrop: calls gdexdrop:main() as gdexdata
 ```
 
 ## Github

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.1}/README.md

@@ -7,7 +7,7 @@ via setuid for effective and common user names.
 user, then `execv`s a Python entry point script.  This allows Python programs to run
 as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
 
-Two modes are supported:
+Three modes are supported:
 
 - **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
   as the common user.
@@ -15,6 +15,10 @@ Two modes are supported:
   runs any command as `<loginname>` via `pgstart.py`.  `<loginname>` can be any
   user that belongs to the same group as `PGLOG['COMMONUSER']`.  Execution is
   restricted to authorized callers (see `pgstart.py` below).
+- **Mode 3 (cmwrapper, callers outside the group):** a dedicated binary compiled
+  from `cmwrapper.c` and installed `4755` runs ONE fixed program as the common
+  user for any user on the machine, including users outside the common user's
+  group (see "cmwrapper" below).
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -197,6 +201,45 @@ pywrapper-install -l|--link dsarch -s|--simple
 pywrapper-install -l|--link all -s|--simple   # or link all setuid_* entries at once
 ```
 
+### cmwrapper (Mode 3, for callers outside the CommonUser group)
+
+`pywrapper` is installed `4750`, so only members of the common user's group can
+execute it.  That group restriction is what makes it safe for `pywrapper` to pick
+the program to run from `basename(argv[0])`: anyone who can execute it can already
+reach every `setuid_*` entry in `bin/` just by naming the symlink differently.
+
+`cmwrapper` is for the opposite case — letting users who are **not** in the common
+user's group run one specific program as the common user.  It is installed `4755`,
+i.e. executable by everyone, so nothing about what it runs may come from the caller:
+
+- the absolute path of the script to exec, and the program name, are baked into the
+  binary at compile time, so it cannot be symlinked under another name to reach a
+  different program;
+- the environment is replaced with a fixed whitelist (`HOME`, `USER`, `LOGNAME`,
+  `TERM`, `LANG`, `TZ`, a fixed `PATH` and `PYTHONNOUSERSITE=1`), so `PYTHONPATH`,
+  `PYTHONHOME`, `LD_PRELOAD`, `LD_LIBRARY_PATH` and the `PGLOG` path variables
+  (`DSDHOME`, `DSSHOME`, `LOGPATH`, `COMMONUSER`, ...) cannot be used to run
+  arbitrary code, or redirect where files are written, as the common user.
+
+One binary is compiled per wrapped program:
+
+```bash
+# Install bin/gdexdrop as a 4755 binary that execs bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop
+
+# Same, but installed into a common area already on everyone's PATH:
+pywrapper-install -m|--cmlink gdexdrop -d|--destdir /glade/u/home/gdexdata/bin
+
+# Point it at a script somewhere other than bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop -t|--target /path/to/setuid_gdexdrop
+```
+
+Only wrap a program that does its own authorization and confines where it writes,
+such as `gdexdrop`, which checks its caller against an access list and copies only
+into the requested dataset directory.  Never wrap a general purpose program such as
+`gdexcp`: at `4755` that would let any user on the machine read or overwrite any
+file of the common user.
+
 ## Runtime flow
 
 ```
@@ -204,6 +247,11 @@ user runs:  dsarch [args]
               |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
 pywrapper.c:  execv(bin/setuid_dsarch, args)
 setuid_dsarch: calls dsarch:main() as gdexdata
+
+user runs:  gdexdrop [args]
+              |  (dedicated 4755 binary, setuid bit -> EUID=gdexdata)
+cmwrapper.c:  execve(bin/setuid_gdexdrop, args, sanitized env)
+setuid_gdexdrop: calls gdexdrop:main() as gdexdata
 ```
 
 ## Github

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.1}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rda_python_setuid"
-version = "3.0.0"
+version = "3.0.1"
 authors = [
   { name="Zaihua Ji", email="zji@ucar.edu" },
 ]
@@ -30,7 +30,7 @@ include-package-data = true
 where = ["src"]
 
 [tool.setuptools.package-data]
-"rda_python_setuid" = ["pywrapper.c", "install.usg", "setuid_setup.usg"]
+"rda_python_setuid" = ["pywrapper.c", "cmwrapper.c", "install.usg", "setuid_setup.usg"]
 
 [project.urls]
 "Homepage" = "https://github.com/NCAR/rda-python-setuid"

rda_python_setuid-3.0.1/src/rda_python_setuid/cmwrapper.c

@@ -0,0 +1,85 @@
+/***************************************************************************************\
+ *
+ *    Title: cmwrapper.c
+ *   Author: Zaihua Ji, zji@ucar.edu
+ *     Date: 2026-09-23
+ *  Purpose: C wrapper to start ONE fixed python program as an effective user, for
+ *           callers who are NOT in the common user's group (Mode 4755).
+ *
+ * Difference from pywrapper.c:
+ *    pywrapper is installed 4750, so only members of the common user's group can
+ *    execute it, and it picks the program to exec from basename(argv[0]) with the
+ *    directory taken from /proc/self/exe.  That is safe only because of the 4750
+ *    group restriction: anyone who can run it can already run every setuid_* entry
+ *    in the bin directory just by naming the symlink differently.
+ *
+ *    cmwrapper is installed 4755, i.e. executable by EVERY user on the machine, so
+ *    neither the program nor its directory may come from the caller:
+ *      - the absolute path of the program to exec is baked in at compile time as
+ *        CMEXEC, and the program name reported to the program is baked in as CMPROG;
+ *      - the environment is replaced with a fixed whitelist, so PYTHONPATH,
+ *        PYTHONHOME, LD_PRELOAD, LD_LIBRARY_PATH and the PGLOG path variables
+ *        (DSDHOME, DSSHOME, LOGPATH, COMMONUSER, ...) cannot be used to run
+ *        arbitrary code, or redirect where files are written, as the common user.
+ *
+ *    One cmwrapper binary is therefore compiled per wrapped program; it can NOT be
+ *    symlinked under another name to reach a different program.
+ *
+ * IMPORTANT: a program wrapped by cmwrapper is callable by anybody, so it must do
+ *    its own authorization (as gdexdrop does with its access list) and must confine
+ *    where it writes.  Do NOT wrap a general purpose program such as gdexcp.
+ *
+ * Instruction:
+ *    # Compile and install bin/PROGRAM as a 4755 setuid binary owned by CommonUser:
+ *    pywrapper-install -m|--cmlink PROGRAM [-n|--username CommonUser] [-e|--envhome $ENVHOME]
+ *
+ \***************************************************************************************/
+
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#ifndef CMPROG
+#error "CMPROG must be defined at compile time, e.g. -DCMPROG=\"gdexdrop\""
+#endif
+#ifndef CMEXEC
+#error "CMEXEC must be defined at compile time, e.g. -DCMEXEC=\"/env/bin/setuid_gdexdrop\""
+#endif
+
+#define CMPATH "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+
+/* Environment variables passed through from the caller.  Everything else is
+   dropped; in particular every PYTHON*, LD_* and PGLOG path variable. */
+static const char *keepvars[] = {"HOME", "USER", "LOGNAME", "TERM", "LANG", "TZ", NULL};
+
+/* main program */
+int main(int argc, char *argv[]) {
+   (void)argc;
+
+   char *envp[16];
+   char *value, *entry;
+   size_t len;
+   int i, n = 0;
+
+   for(i = 0; keepvars[i] != NULL; i++) {
+      value = getenv(keepvars[i]);
+      if(value == NULL) continue;
+      len = strlen(keepvars[i]) + strlen(value) + 2;
+      entry = malloc(len);
+      if(entry == NULL) {
+         perror(CMPROG ": malloc");
+         exit(1);
+      }
+      snprintf(entry, len, "%s=%s", keepvars[i], value);
+      envp[n++] = entry;
+   }
+   envp[n++] = (char *)"PATH=" CMPATH;
+   envp[n++] = (char *)"PYTHONNOUSERSITE=1";   /* ignore ~/.local site-packages */
+   envp[n] = NULL;
+
+   argv[0] = (char *)CMPROG;   /* the program identifies itself by this name */
+   execve(CMEXEC, argv, envp);
+   perror(CMEXEC);   /* execve only returns on error */
+   exit(1);
+}

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.1}/src/rda_python_setuid/install.py

@@ -32,6 +32,10 @@
 #   # 5. Update existing installation (recompile and reinstall all setuid binaries):
 #   pywrapper-install -u [-n gdexdata] [-e $ENVHOME]
 #
+#   # 6. Compile a dedicated 4755 cmwrapper binary, so users outside the CommonUser
+#   #    group can run one fixed program as CommonUser:
+#   pywrapper-install -m myprog [-t SCRIPT] [-d DESTDIR] [-n gdexdata] [-e $ENVHOME]
+#
 # Convention for wrapped programs:
 #   The target package must register its connector entry point with a setuid_ prefix:
 #      [project.scripts]
@@ -47,6 +51,7 @@
 
 import argparse
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -57,9 +62,9 @@ def get_bindir():
    return os.path.dirname(os.path.abspath(sys.executable))
 
 
-def get_c_source():
-   """Return path to pywrapper.c bundled with this package."""
-   return os.path.join(os.path.dirname(__file__), 'pywrapper.c')
+def get_c_source(name='pywrapper.c'):
+   """Return path to a C source file bundled with this package."""
+   return os.path.join(os.path.dirname(__file__), name)
 
 
 def run(cmd):
@@ -103,13 +108,25 @@ def main():
       '-l', '--link', metavar='PROGRAM',
       help="Create symlink PROGRAM -> pywrapper for running a fixed program as CommonUser (Mode 1); use 'all' to auto-link every setuid_* entry not yet linked"
    )
+   group.add_argument(
+      '-m', '--cmlink', metavar='PROGRAM',
+      help="Compile a dedicated 4755 cmwrapper binary for PROGRAM, so users outside the CommonUser group can run it (Mode 3)"
+   )
    group.add_argument(
       '-u', '--update', action='store_true',
       help="Update an existing installation: recompile pywrapper and reinstall all pgstart_USER setuid binaries"
    )
+   parser.add_argument(
+      '-t', '--target', default=None,
+      help="Absolute path of the python script a cmwrapper binary execs (default: BINDIR/setuid_PROGRAM; use with -m/--cmlink)"
+   )
+   parser.add_argument(
+      '-d', '--destdir', default=None,
+      help="Directory to install a cmwrapper binary into, such as a common area on everyone's PATH (default: BINDIR; use with -m/--cmlink)"
+   )
    args = parser.parse_args()
 
-   if not (args.compile or args.pgstart or args.link or args.update):
+   if not (args.compile or args.pgstart or args.link or args.cmlink or args.update):
       show_usage()
 
    if args.username is None and not args.simple:
@@ -211,6 +228,33 @@ def main():
       run(['sudo', '-u', args.username, 'chmod', '4750', pywrapper])
       print("Installed: {} (setuid, owned by {})".format(pywrapper, args.username))
 
+   elif args.cmlink:
+      # Mode 3: compile a dedicated cmwrapper binary for one program and install it
+      # 4755, so users outside the CommonUser group can run it.  The program path is
+      # baked in at compile time and the environment is sanitized by cmwrapper.c, so
+      # no symlink under another name can reach a different program.
+      if not re.match(r'^\w+$', args.cmlink):
+         print("Error: invalid program name '{}', expecting word characters only.".format(args.cmlink))
+         sys.exit(1)
+      script = args.target if args.target else os.path.join(bindir, 'setuid_' + args.cmlink)
+      if not (os.path.isabs(script) and re.match(r'^[\w/.-]+$', script)):
+         print("Error: {} of -t/--target must be an absolute path of word characters, '/', '.' and '-'.".format(script))
+         sys.exit(1)
+      if not os.path.exists(script):
+         print("Error: {} not found. Install the package that provides it first.".format(script))
+         sys.exit(1)
+      destdir = args.destdir if args.destdir else bindir
+      target = os.path.join(destdir, args.cmlink)
+      src = get_c_source('cmwrapper.c')
+      src_dest = os.path.join(bindir, 'cmwrapper.c')
+      shutil.copy(src, src_dest)
+      print("Copied: {}".format(src_dest))
+      run(['sudo', '-u', args.username, 'gcc',
+           '-DCMPROG="{}"'.format(args.cmlink), '-DCMEXEC="{}"'.format(script),
+           '-o', target, src_dest])
+      run(['sudo', '-u', args.username, 'chmod', '4755', target])
+      print("Installed: {} (setuid, owned by {}, execs {})".format(target, args.username, script))
+
    elif args.update:
       # Update an existing installation: recompile pywrapper and reinstall all setuid binaries
       pgstart_files = sorted(f for f in os.listdir(bindir) if f.startswith('pgstart_'))

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.1}/src/rda_python_setuid/install.usg

@@ -6,11 +6,12 @@
                           ( -c|--compile
                           | -p|--pgstart
                           | -l|--link PROGRAM|all [-s|--simple]
+                          | -m|--cmlink PROGRAM [-t|--target SCRIPT] [-d|--destdir DIR]
                           | -u|--update )
 
  Run pywrapper-install with no arguments to display this user guide.  Exactly
- one of -c/--compile, -p/--pgstart, -l/--link, or -u/--update must be given
- to perform an action.
+ one of -c/--compile, -p/--pgstart, -l/--link, -m/--cmlink, or -u/--update
+ must be given to perform an action.
 
       - Option -n or --username USERNAME
           The user name to own the setuid binary.  For Mode 1 (CommonUser program),
@@ -49,6 +50,31 @@
           Use 'all' instead of a program name to scan bin/ for every setuid_*
           entry and add any missing PROGRAM -> pywrapper symlinks in one pass.
 
+      - Option -m or --cmlink PROGRAM
+          Mode 3: compile cmwrapper.c (bundled with this package) into a dedicated
+          binary named PROGRAM, owned by USER with chmod 4755 (setuid), so that
+          users who are NOT in the common user's group can run PROGRAM as
+          CommonUser.  Unlike pywrapper, the script to exec is baked into the
+          binary at compile time and the environment is replaced with a fixed
+          whitelist, so the binary cannot be symlinked under another name to reach
+          a different program, and PYTHONPATH, LD_PRELOAD or the PGLOG path
+          variables cannot be used to run code as CommonUser.  One binary is
+          compiled per program.  Cannot be combined with the other actions.
+
+          Only wrap a program that does its own authorization and confines where
+          it writes, such as gdexdrop; never wrap a general purpose program such
+          as gdexcp, which would let any user on the machine read or overwrite
+          any file of the common user.
+
+      - Option -t or --target SCRIPT (use with -m/--cmlink)
+          Absolute path of the python script the cmwrapper binary execs.
+          Defaults to bin/setuid_PROGRAM of the environment.
+
+      - Option -d or --destdir DIR (use with -m/--cmlink)
+          Directory to install the cmwrapper binary into, typically a common area
+          on everyone's PATH, such as /glade/u/home/gdexdata/bin.  Defaults to the
+          bin/ directory of the environment.
+
       - Option -u or --update
           Update an existing installation.  Discovers all pgstart_* and pywrapper
           binaries already present in bin/, saves them to a temporary update_tmp/
@@ -170,3 +196,7 @@
 
    8. Simple install of all setuid_* entries at once:
          pywrapper-install -l all -s
+
+   9. Let users outside the gdexdata group run gdexdrop as gdexdata, installing
+      the 4755 binary into a common area on everyone's PATH:
+         pywrapper-install -m gdexdrop -d /glade/u/home/gdexdata/bin

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.1/src/rda_python_setuid.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 3.0.0
+Version: 3.0.1
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -23,7 +23,7 @@ via setuid for effective and common user names.
 user, then `execv`s a Python entry point script.  This allows Python programs to run
 as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
 
-Two modes are supported:
+Three modes are supported:
 
 - **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
   as the common user.
@@ -31,6 +31,10 @@ Two modes are supported:
   runs any command as `<loginname>` via `pgstart.py`.  `<loginname>` can be any
   user that belongs to the same group as `PGLOG['COMMONUSER']`.  Execution is
   restricted to authorized callers (see `pgstart.py` below).
+- **Mode 3 (cmwrapper, callers outside the group):** a dedicated binary compiled
+  from `cmwrapper.c` and installed `4755` runs ONE fixed program as the common
+  user for any user on the machine, including users outside the common user's
+  group (see "cmwrapper" below).
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -213,6 +217,45 @@ pywrapper-install -l|--link dsarch -s|--simple
 pywrapper-install -l|--link all -s|--simple   # or link all setuid_* entries at once
 ```
 
+### cmwrapper (Mode 3, for callers outside the CommonUser group)
+
+`pywrapper` is installed `4750`, so only members of the common user's group can
+execute it.  That group restriction is what makes it safe for `pywrapper` to pick
+the program to run from `basename(argv[0])`: anyone who can execute it can already
+reach every `setuid_*` entry in `bin/` just by naming the symlink differently.
+
+`cmwrapper` is for the opposite case — letting users who are **not** in the common
+user's group run one specific program as the common user.  It is installed `4755`,
+i.e. executable by everyone, so nothing about what it runs may come from the caller:
+
+- the absolute path of the script to exec, and the program name, are baked into the
+  binary at compile time, so it cannot be symlinked under another name to reach a
+  different program;
+- the environment is replaced with a fixed whitelist (`HOME`, `USER`, `LOGNAME`,
+  `TERM`, `LANG`, `TZ`, a fixed `PATH` and `PYTHONNOUSERSITE=1`), so `PYTHONPATH`,
+  `PYTHONHOME`, `LD_PRELOAD`, `LD_LIBRARY_PATH` and the `PGLOG` path variables
+  (`DSDHOME`, `DSSHOME`, `LOGPATH`, `COMMONUSER`, ...) cannot be used to run
+  arbitrary code, or redirect where files are written, as the common user.
+
+One binary is compiled per wrapped program:
+
+```bash
+# Install bin/gdexdrop as a 4755 binary that execs bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop
+
+# Same, but installed into a common area already on everyone's PATH:
+pywrapper-install -m|--cmlink gdexdrop -d|--destdir /glade/u/home/gdexdata/bin
+
+# Point it at a script somewhere other than bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop -t|--target /path/to/setuid_gdexdrop
+```
+
+Only wrap a program that does its own authorization and confines where it writes,
+such as `gdexdrop`, which checks its caller against an access list and copies only
+into the requested dataset directory.  Never wrap a general purpose program such as
+`gdexcp`: at `4755` that would let any user on the machine read or overwrite any
+file of the common user.
+
 ## Runtime flow
 
 ```
@@ -220,6 +263,11 @@ user runs:  dsarch [args]
               |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
 pywrapper.c:  execv(bin/setuid_dsarch, args)
 setuid_dsarch: calls dsarch:main() as gdexdata
+
+user runs:  gdexdrop [args]
+              |  (dedicated 4755 binary, setuid bit -> EUID=gdexdata)
+cmwrapper.c:  execve(bin/setuid_gdexdrop, args, sanitized env)
+setuid_gdexdrop: calls gdexdrop:main() as gdexdata
 ```
 
 ## Github

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.1}/src/rda_python_setuid.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ MANIFEST.in
 README.md
 pyproject.toml
 src/rda_python_setuid/__init__.py
+src/rda_python_setuid/cmwrapper.c
 src/rda_python_setuid/install.py
 src/rda_python_setuid/install.usg
 src/rda_python_setuid/pgstart.py