rda-python-setuid 3.0.0__tar.gz → 3.0.2__tar.gz

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.2}/MANIFEST.in

@@ -1,2 +1,3 @@
 include src/rda_python_setuid/pywrapper.c
+include src/rda_python_setuid/cmwrapper.c
 include src/rda_python_setuid/install.usg

{rda_python_setuid-3.0.0/src/rda_python_setuid.egg-info → rda_python_setuid-3.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 3.0.0
+Version: 3.0.2
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -23,7 +23,7 @@ via setuid for effective and common user names.
 user, then `execv`s a Python entry point script.  This allows Python programs to run
 as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
 
-Two modes are supported:
+Three modes are supported:
 
 - **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
   as the common user.
@@ -31,6 +31,12 @@ Two modes are supported:
   runs any command as `<loginname>` via `pgstart.py`.  `<loginname>` can be any
   user that belongs to the same group as `PGLOG['COMMONUSER']`.  Execution is
   restricted to authorized callers (see `pgstart.py` below).
+- **Mode 3 (cmwrapper, callers outside the group):** a dedicated binary compiled
+  from `cmwrapper.c` and installed `4755` runs ONE fixed program as the common
+  user for any user on the machine, including users outside the common user's
+  group (see "cmwrapper" below).  With `-s|--simple` the same binary is installed
+  `755` with no setuid, which publishes ONE program of this environment to users
+  who have no environment of their own.
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -213,6 +219,63 @@ pywrapper-install -l|--link dsarch -s|--simple
 pywrapper-install -l|--link all -s|--simple   # or link all setuid_* entries at once
 ```
 
+### cmwrapper (Mode 3, for callers outside the CommonUser group)
+
+`pywrapper` is installed `4750`, so only members of the common user's group can
+execute it.  That group restriction is what makes it safe for `pywrapper` to pick
+the program to run from `basename(argv[0])`: anyone who can execute it can already
+reach every `setuid_*` entry in `bin/` just by naming the symlink differently.
+
+`cmwrapper` is for the opposite case — letting users who are **not** in the common
+user's group run one specific program as the common user.  It is installed `4755`,
+i.e. executable by everyone, so nothing about what it runs may come from the caller:
+
+- the absolute path of the script to exec, and the program name, are baked into the
+  binary at compile time, so it cannot be symlinked under another name to reach a
+  different program;
+- the environment is replaced with a fixed whitelist (`HOME`, `USER`, `LOGNAME`,
+  `TERM`, `LANG`, `TZ`, a fixed `PATH` and `PYTHONNOUSERSITE=1`), so `PYTHONPATH`,
+  `PYTHONHOME`, `LD_PRELOAD`, `LD_LIBRARY_PATH` and the `PGLOG` path variables
+  (`DSDHOME`, `DSSHOME`, `LOGPATH`, `COMMONUSER`, ...) cannot be used to run
+  arbitrary code, or redirect where files are written, as the common user.
+
+One binary is compiled per wrapped program:
+
+```bash
+# Install bin/gdexdrop as a 4755 binary that execs bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop
+
+# Same, but installed into a common area already on everyone's PATH:
+pywrapper-install -m|--cmlink gdexdrop -d|--destdir /glade/u/home/gdexdata/bin
+
+# Point it at a script somewhere other than bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop -t|--target /path/to/setuid_gdexdrop
+```
+
+Only wrap a program that does its own authorization and confines where it writes,
+such as `gdexdrop`, which checks its caller against an access list and copies only
+into the requested dataset directory.  Never wrap a general purpose program such as
+`gdexcp`: at `4755` that would let any user on the machine read or overwrite any
+file of the common user.
+
+### cmwrapper with no setuid, to publish a program of this environment
+
+Add `-s|--simple` to compile the binary `755` with no setuid bit.  Nothing runs as
+another user; the binary exists only so that users who do not have this environment,
+and cannot activate a venv or a conda environment, can still run one of its programs
+by name — `gdexls`, for example:
+
+```bash
+# Install /glade/u/apps/contrib/gdexls, a 755 binary that execs bin/gdexls:
+pywrapper-install -m|--cmlink gdexls -s|--simple -d|--destdir /glade/u/apps/contrib
+```
+
+Since there is no privilege change, sanitizing the environment would buy no security
+and would only break the caller's own settings, so the caller's environment is passed
+through except for `PYTHONPATH`, `PYTHONHOME` and `PYTHONSTARTUP`, which would send
+the program to another environment's modules.  The default `-t|--target` is
+`bin/PROGRAM` rather than `bin/setuid_PROGRAM`, and no `sudo` access is required.
+
 ## Runtime flow
 
 ```
@@ -220,6 +283,16 @@ user runs:  dsarch [args]
               |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
 pywrapper.c:  execv(bin/setuid_dsarch, args)
 setuid_dsarch: calls dsarch:main() as gdexdata
+
+user runs:  gdexdrop [args]
+              |  (dedicated 4755 binary, setuid bit -> EUID=gdexdata)
+cmwrapper.c:  execve(bin/setuid_gdexdrop, args, sanitized env)
+setuid_gdexdrop: calls gdexdrop:main() as gdexdata
+
+user runs:  gdexls [args]
+              |  (dedicated 755 binary, no setuid, -DCMSIMPLE)
+cmwrapper.c:  execv(bin/gdexls, args)
+gdexls:       calls gdexls:main() as the calling user
 ```
 
 ## Github

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.2}/README.md

@@ -7,7 +7,7 @@ via setuid for effective and common user names.
 user, then `execv`s a Python entry point script.  This allows Python programs to run
 as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
 
-Two modes are supported:
+Three modes are supported:
 
 - **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
   as the common user.
@@ -15,6 +15,12 @@ Two modes are supported:
   runs any command as `<loginname>` via `pgstart.py`.  `<loginname>` can be any
   user that belongs to the same group as `PGLOG['COMMONUSER']`.  Execution is
   restricted to authorized callers (see `pgstart.py` below).
+- **Mode 3 (cmwrapper, callers outside the group):** a dedicated binary compiled
+  from `cmwrapper.c` and installed `4755` runs ONE fixed program as the common
+  user for any user on the machine, including users outside the common user's
+  group (see "cmwrapper" below).  With `-s|--simple` the same binary is installed
+  `755` with no setuid, which publishes ONE program of this environment to users
+  who have no environment of their own.
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -197,6 +203,63 @@ pywrapper-install -l|--link dsarch -s|--simple
 pywrapper-install -l|--link all -s|--simple   # or link all setuid_* entries at once
 ```
 
+### cmwrapper (Mode 3, for callers outside the CommonUser group)
+
+`pywrapper` is installed `4750`, so only members of the common user's group can
+execute it.  That group restriction is what makes it safe for `pywrapper` to pick
+the program to run from `basename(argv[0])`: anyone who can execute it can already
+reach every `setuid_*` entry in `bin/` just by naming the symlink differently.
+
+`cmwrapper` is for the opposite case — letting users who are **not** in the common
+user's group run one specific program as the common user.  It is installed `4755`,
+i.e. executable by everyone, so nothing about what it runs may come from the caller:
+
+- the absolute path of the script to exec, and the program name, are baked into the
+  binary at compile time, so it cannot be symlinked under another name to reach a
+  different program;
+- the environment is replaced with a fixed whitelist (`HOME`, `USER`, `LOGNAME`,
+  `TERM`, `LANG`, `TZ`, a fixed `PATH` and `PYTHONNOUSERSITE=1`), so `PYTHONPATH`,
+  `PYTHONHOME`, `LD_PRELOAD`, `LD_LIBRARY_PATH` and the `PGLOG` path variables
+  (`DSDHOME`, `DSSHOME`, `LOGPATH`, `COMMONUSER`, ...) cannot be used to run
+  arbitrary code, or redirect where files are written, as the common user.
+
+One binary is compiled per wrapped program:
+
+```bash
+# Install bin/gdexdrop as a 4755 binary that execs bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop
+
+# Same, but installed into a common area already on everyone's PATH:
+pywrapper-install -m|--cmlink gdexdrop -d|--destdir /glade/u/home/gdexdata/bin
+
+# Point it at a script somewhere other than bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop -t|--target /path/to/setuid_gdexdrop
+```
+
+Only wrap a program that does its own authorization and confines where it writes,
+such as `gdexdrop`, which checks its caller against an access list and copies only
+into the requested dataset directory.  Never wrap a general purpose program such as
+`gdexcp`: at `4755` that would let any user on the machine read or overwrite any
+file of the common user.
+
+### cmwrapper with no setuid, to publish a program of this environment
+
+Add `-s|--simple` to compile the binary `755` with no setuid bit.  Nothing runs as
+another user; the binary exists only so that users who do not have this environment,
+and cannot activate a venv or a conda environment, can still run one of its programs
+by name — `gdexls`, for example:
+
+```bash
+# Install /glade/u/apps/contrib/gdexls, a 755 binary that execs bin/gdexls:
+pywrapper-install -m|--cmlink gdexls -s|--simple -d|--destdir /glade/u/apps/contrib
+```
+
+Since there is no privilege change, sanitizing the environment would buy no security
+and would only break the caller's own settings, so the caller's environment is passed
+through except for `PYTHONPATH`, `PYTHONHOME` and `PYTHONSTARTUP`, which would send
+the program to another environment's modules.  The default `-t|--target` is
+`bin/PROGRAM` rather than `bin/setuid_PROGRAM`, and no `sudo` access is required.
+
 ## Runtime flow
 
 ```
@@ -204,6 +267,16 @@ user runs:  dsarch [args]
               |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
 pywrapper.c:  execv(bin/setuid_dsarch, args)
 setuid_dsarch: calls dsarch:main() as gdexdata
+
+user runs:  gdexdrop [args]
+              |  (dedicated 4755 binary, setuid bit -> EUID=gdexdata)
+cmwrapper.c:  execve(bin/setuid_gdexdrop, args, sanitized env)
+setuid_gdexdrop: calls gdexdrop:main() as gdexdata
+
+user runs:  gdexls [args]
+              |  (dedicated 755 binary, no setuid, -DCMSIMPLE)
+cmwrapper.c:  execv(bin/gdexls, args)
+gdexls:       calls gdexls:main() as the calling user
 ```
 
 ## Github

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.2}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rda_python_setuid"
-version = "3.0.0"
+version = "3.0.2"
 authors = [
   { name="Zaihua Ji", email="zji@ucar.edu" },
 ]
@@ -30,7 +30,7 @@ include-package-data = true
 where = ["src"]
 
 [tool.setuptools.package-data]
-"rda_python_setuid" = ["pywrapper.c", "install.usg", "setuid_setup.usg"]
+"rda_python_setuid" = ["pywrapper.c", "cmwrapper.c", "install.usg", "setuid_setup.usg"]
 
 [project.urls]
 "Homepage" = "https://github.com/NCAR/rda-python-setuid"

rda_python_setuid-3.0.2/src/rda_python_setuid/cmwrapper.c

@@ -0,0 +1,120 @@
+/***************************************************************************************\
+ *
+ *    Title: cmwrapper.c
+ *   Author: Zaihua Ji, zji@ucar.edu
+ *     Date: 2026-09-23
+ *  Purpose: C wrapper to start ONE fixed python program as an effective user, for
+ *           callers who are NOT in the common user's group (Mode 4755).
+ *
+ * Difference from pywrapper.c:
+ *    pywrapper is installed 4750, so only members of the common user's group can
+ *    execute it, and it picks the program to exec from basename(argv[0]) with the
+ *    directory taken from /proc/self/exe.  That is safe only because of the 4750
+ *    group restriction: anyone who can run it can already run every setuid_* entry
+ *    in the bin directory just by naming the symlink differently.
+ *
+ *    cmwrapper is installed 4755, i.e. executable by EVERY user on the machine, so
+ *    neither the program nor its directory may come from the caller:
+ *      - the absolute path of the program to exec is baked in at compile time as
+ *        CMEXEC, and the program name reported to the program is baked in as CMPROG;
+ *      - the environment is replaced with a fixed whitelist, so PYTHONPATH,
+ *        PYTHONHOME, LD_PRELOAD, LD_LIBRARY_PATH and the PGLOG path variables
+ *        (DSDHOME, DSSHOME, LOGPATH, COMMONUSER, ...) cannot be used to run
+ *        arbitrary code, or redirect where files are written, as the common user.
+ *
+ *    One cmwrapper binary is therefore compiled per wrapped program; it can NOT be
+ *    symlinked under another name to reach a different program.
+ *
+ * IMPORTANT: a program wrapped by cmwrapper is callable by anybody, so it must do
+ *    its own authorization (as gdexdrop does with its access list) and must confine
+ *    where it writes.  Do NOT wrap a general purpose program such as gdexcp.
+ *
+ * Instruction:
+ *    # Compile and install bin/PROGRAM as a 4755 setuid binary owned by CommonUser:
+ *    pywrapper-install -m|--cmlink PROGRAM [-n|--username CommonUser] [-e|--envhome $ENVHOME]
+ *
+ *    # Compile it 755 with no setuid, to publish a program of an environment to
+ *    # users who do not have that environment (-DCMSIMPLE):
+ *    pywrapper-install -m|--cmlink PROGRAM -s|--simple [-d|--destdir DIR]
+ *
+ *    With -DCMSIMPLE there is no privilege change, so the caller's environment is
+ *    kept except for PYTHONPATH, PYTHONHOME and PYTHONSTARTUP, which would send the
+ *    program to another environment's modules.  Sanitizing the rest would buy no
+ *    security and would only break the caller's own settings.
+ *
+ \***************************************************************************************/
+
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#ifndef CMPROG
+#error "CMPROG must be defined at compile time, e.g. -DCMPROG=\"gdexdrop\""
+#endif
+#ifndef CMEXEC
+#error "CMEXEC must be defined at compile time, e.g. -DCMEXEC=\"/env/bin/setuid_gdexdrop\""
+#endif
+
+#ifdef CMSIMPLE
+
+/* Python variables of the caller that would make the wrapped program load modules
+   from somewhere other than its own environment. */
+static const char *dropvars[] = {"PYTHONPATH", "PYTHONHOME", "PYTHONSTARTUP", NULL};
+
+#else
+
+#define CMPATH "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+
+/* Environment variables passed through from the caller.  Everything else is
+   dropped; in particular every PYTHON*, LD_* and PGLOG path variable. */
+static const char *keepvars[] = {"HOME", "USER", "LOGNAME", "TERM", "LANG", "TZ", NULL};
+
+#endif
+
+/* main program */
+int main(int argc, char *argv[]) {
+   (void)argc;
+
+#ifdef CMSIMPLE
+
+   /* No privilege change, so sanitizing the environment buys no security and can
+      only break the caller's own settings.  Only the Python variables that would
+      send the program to another environment's modules are dropped. */
+   int i;
+
+   for(i = 0; dropvars[i] != NULL; i++) unsetenv(dropvars[i]);
+   argv[0] = (char *)CMPROG;
+   execv(CMEXEC, argv);
+
+#else
+
+   char *envp[16];
+   char *value, *entry;
+   size_t len;
+   int i, n = 0;
+
+   for(i = 0; keepvars[i] != NULL; i++) {
+      value = getenv(keepvars[i]);
+      if(value == NULL) continue;
+      len = strlen(keepvars[i]) + strlen(value) + 2;
+      entry = malloc(len);
+      if(entry == NULL) {
+         perror(CMPROG ": malloc");
+         exit(1);
+      }
+      snprintf(entry, len, "%s=%s", keepvars[i], value);
+      envp[n++] = entry;
+   }
+   envp[n++] = (char *)"PATH=" CMPATH;
+   envp[n++] = (char *)"PYTHONNOUSERSITE=1";   /* ignore ~/.local site-packages */
+   envp[n] = NULL;
+
+   argv[0] = (char *)CMPROG;   /* the program identifies itself by this name */
+   execve(CMEXEC, argv, envp);
+
+#endif
+
+   perror(CMEXEC);   /* exec only returns on error */
+   exit(1);
+}

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.2}/src/rda_python_setuid/install.py

@@ -32,6 +32,14 @@
 #   # 5. Update existing installation (recompile and reinstall all setuid binaries):
 #   pywrapper-install -u [-n gdexdata] [-e $ENVHOME]
 #
+#   # 6. Compile a dedicated 4755 cmwrapper binary, so users outside the CommonUser
+#   #    group can run one fixed program as CommonUser:
+#   pywrapper-install -m myprog [-t SCRIPT] [-d DESTDIR] [-n gdexdata] [-e $ENVHOME]
+#
+#   # 6b. Compile it 755 with no setuid, to publish a program of this environment to
+#   #     users who do not have the environment at all:
+#   pywrapper-install -m myprog -s [-t SCRIPT] [-d DESTDIR] [-e $ENVHOME]
+#
 # Convention for wrapped programs:
 #   The target package must register its connector entry point with a setuid_ prefix:
 #      [project.scripts]
@@ -47,6 +55,7 @@
 
 import argparse
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -57,9 +66,9 @@ def get_bindir():
    return os.path.dirname(os.path.abspath(sys.executable))
 
 
-def get_c_source():
-   """Return path to pywrapper.c bundled with this package."""
-   return os.path.join(os.path.dirname(__file__), 'pywrapper.c')
+def get_c_source(name='pywrapper.c'):
+   """Return path to a C source file bundled with this package."""
+   return os.path.join(os.path.dirname(__file__), name)
 
 
 def run(cmd):
@@ -88,7 +97,7 @@ def main():
    )
    parser.add_argument(
       '-s', '--simple', action='store_true',
-      help="Simple install: create symlink PROGRAM -> setuid_PROGRAM, skipping setuid (use with -l/--link)"
+      help="Simple install, skipping setuid: symlink PROGRAM -> setuid_PROGRAM with -l/--link, or a 755 cmwrapper binary with -m/--cmlink"
    )
    group = parser.add_mutually_exclusive_group()
    group.add_argument(
@@ -103,13 +112,25 @@ def main():
       '-l', '--link', metavar='PROGRAM',
       help="Create symlink PROGRAM -> pywrapper for running a fixed program as CommonUser (Mode 1); use 'all' to auto-link every setuid_* entry not yet linked"
    )
+   group.add_argument(
+      '-m', '--cmlink', metavar='PROGRAM',
+      help="Compile a dedicated 4755 cmwrapper binary for PROGRAM, so users outside the CommonUser group can run it (Mode 3); add -s/--simple for a 755 binary with no setuid"
+   )
    group.add_argument(
       '-u', '--update', action='store_true',
       help="Update an existing installation: recompile pywrapper and reinstall all pgstart_USER setuid binaries"
    )
+   parser.add_argument(
+      '-t', '--target', default=None,
+      help="Absolute path of the python script a cmwrapper binary execs (default: BINDIR/setuid_PROGRAM, or BINDIR/PROGRAM with -s/--simple; use with -m/--cmlink)"
+   )
+   parser.add_argument(
+      '-d', '--destdir', default=None,
+      help="Directory to install a cmwrapper binary into, such as a common area on everyone's PATH (default: BINDIR; use with -m/--cmlink)"
+   )
    args = parser.parse_args()
 
-   if not (args.compile or args.pgstart or args.link or args.update):
+   if not (args.compile or args.pgstart or args.link or args.cmlink or args.update):
       show_usage()
 
    if args.username is None and not args.simple:
@@ -211,6 +232,45 @@ def main():
       run(['sudo', '-u', args.username, 'chmod', '4750', pywrapper])
       print("Installed: {} (setuid, owned by {})".format(pywrapper, args.username))
 
+   elif args.cmlink:
+      # Mode 3: compile a dedicated cmwrapper binary for one program and install it
+      # 4755, so users outside the CommonUser group can run it.  The program path is
+      # baked in at compile time and the environment is sanitized by cmwrapper.c, so
+      # no symlink under another name can reach a different program.
+      # With -s/--simple the binary is 755 with no setuid, which publishes a program
+      # of this environment to users who do not have the environment at all.
+      if not re.match(r'^\w+$', args.cmlink):
+         print("Error: invalid program name '{}', expecting word characters only.".format(args.cmlink))
+         sys.exit(1)
+      if args.target:
+         script = args.target
+      else:
+         script = os.path.join(bindir, args.cmlink if args.simple else 'setuid_' + args.cmlink)
+      if not (os.path.isabs(script) and re.match(r'^[\w/.-]+$', script)):
+         print("Error: {} of -t/--target must be an absolute path of word characters, '/', '.' and '-'.".format(script))
+         sys.exit(1)
+      if not os.path.exists(script):
+         print("Error: {} not found. Install the package that provides it first.".format(script))
+         sys.exit(1)
+      destdir = args.destdir if args.destdir else bindir
+      target = os.path.join(destdir, args.cmlink)
+      if os.path.abspath(target) == os.path.abspath(script):
+         print("Error: the binary {} would overwrite the script it execs; give -d/--destdir or -t/--target.".format(target))
+         sys.exit(1)
+      src = get_c_source('cmwrapper.c')
+      src_dest = os.path.join(bindir, 'cmwrapper.c')
+      shutil.copy(src, src_dest)
+      print("Copied: {}".format(src_dest))
+      cmd = ['gcc', '-DCMPROG="{}"'.format(args.cmlink), '-DCMEXEC="{}"'.format(script)]
+      if args.simple: cmd.append('-DCMSIMPLE')
+      prefix = [] if args.simple else ['sudo', '-u', args.username]
+      run(prefix + cmd + ['-o', target, src_dest])
+      run(prefix + ['chmod', '755' if args.simple else '4755', target])
+      if args.simple:
+         print("Installed: {} (no setuid, execs {})".format(target, script))
+      else:
+         print("Installed: {} (setuid, owned by {}, execs {})".format(target, args.username, script))
+
    elif args.update:
       # Update an existing installation: recompile pywrapper and reinstall all setuid binaries
       pgstart_files = sorted(f for f in os.listdir(bindir) if f.startswith('pgstart_'))

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.2}/src/rda_python_setuid/install.usg

@@ -6,11 +6,13 @@
                           ( -c|--compile
                           | -p|--pgstart
                           | -l|--link PROGRAM|all [-s|--simple]
+                          | -m|--cmlink PROGRAM [-s|--simple] [-t|--target SCRIPT]
+                                                 [-d|--destdir DIR]
                           | -u|--update )
 
  Run pywrapper-install with no arguments to display this user guide.  Exactly
- one of -c/--compile, -p/--pgstart, -l/--link, or -u/--update must be given
- to perform an action.
+ one of -c/--compile, -p/--pgstart, -l/--link, -m/--cmlink, or -u/--update
+ must be given to perform an action.
 
       - Option -n or --username USERNAME
           The user name to own the setuid binary.  For Mode 1 (CommonUser program),
@@ -49,6 +51,40 @@
           Use 'all' instead of a program name to scan bin/ for every setuid_*
           entry and add any missing PROGRAM -> pywrapper symlinks in one pass.
 
+      - Option -m or --cmlink PROGRAM
+          Mode 3: compile cmwrapper.c (bundled with this package) into a dedicated
+          binary named PROGRAM, owned by USER with chmod 4755 (setuid), so that
+          users who are NOT in the common user's group can run PROGRAM as
+          CommonUser.  Unlike pywrapper, the script to exec is baked into the
+          binary at compile time and the environment is replaced with a fixed
+          whitelist, so the binary cannot be symlinked under another name to reach
+          a different program, and PYTHONPATH, LD_PRELOAD or the PGLOG path
+          variables cannot be used to run code as CommonUser.  One binary is
+          compiled per program.  Cannot be combined with the other actions.
+
+          Only wrap a program that does its own authorization and confines where
+          it writes, such as gdexdrop; never wrap a general purpose program such
+          as gdexcp, which would let any user on the machine read or overwrite
+          any file of the common user.
+
+          Add -s/--simple to compile the binary 755 with no setuid, which is how
+          a program of this environment is published to users who do not have the
+          environment at all, such as gdexls.  There is no privilege change, so
+          the caller's environment is kept except for PYTHONPATH, PYTHONHOME and
+          PYTHONSTARTUP, which would send the program to another environment's
+          modules.  The default -t/--target is then bin/PROGRAM, and no sudo
+          access to USER is needed.
+
+      - Option -t or --target SCRIPT (use with -m/--cmlink)
+          Absolute path of the python script the cmwrapper binary execs.
+          Defaults to bin/setuid_PROGRAM of the environment, or to bin/PROGRAM
+          with -s/--simple.
+
+      - Option -d or --destdir DIR (use with -m/--cmlink)
+          Directory to install the cmwrapper binary into, typically a common area
+          on everyone's PATH, such as /glade/u/home/gdexdata/bin.  Defaults to the
+          bin/ directory of the environment.
+
       - Option -u or --update
           Update an existing installation.  Discovers all pgstart_* and pywrapper
           binaries already present in bin/, saves them to a temporary update_tmp/
@@ -56,11 +92,13 @@
           reinstalls every pgstart_* binary from update_tmp.  Use -n/--username to
           specify the gdex common user (default: gdexdata).
 
-      - Option -s or --simple (use with -l/--link)
-          Simple install: create a symlink PROGRAM -> setuid_PROGRAM directly,
-          skipping the setuid mechanism entirely.  The program runs as the current
-          user with no privilege change.  -n/--username is not required with this option.
-          Useful for users who do not need or cannot set up the setuid wrapper.
+      - Option -s or --simple (use with -l/--link or -m/--cmlink)
+          Simple install: skip the setuid mechanism entirely, so that the program
+          runs as the current user with no privilege change.  -n/--username is not
+          required with this option.  With -l/--link, a symlink PROGRAM ->
+          setuid_PROGRAM is created for users who do not need or cannot set up the
+          setuid wrapper; with -m/--cmlink, a 755 cmwrapper binary is compiled for
+          users who do not have this environment at all.
 
  Convention for wrapped programs:
    Any Python package whose program is to be run via pywrapper must:
@@ -170,3 +208,11 @@
 
    8. Simple install of all setuid_* entries at once:
          pywrapper-install -l all -s
+
+   9. Let users outside the gdexdata group run gdexdrop as gdexdata, installing
+      the 4755 binary into a common area on everyone's PATH:
+         pywrapper-install -m gdexdrop -d /glade/u/home/gdexdata/bin
+
+  10. Publish gdexls of this environment to users who have no environment of
+      their own, with no setuid and no privilege change:
+         pywrapper-install -m gdexls -s -d /glade/u/apps/contrib

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.2/src/rda_python_setuid.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 3.0.0
+Version: 3.0.2
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -23,7 +23,7 @@ via setuid for effective and common user names.
 user, then `execv`s a Python entry point script.  This allows Python programs to run
 as a designated common user (e.g. `gdexdata`) without requiring `sudo` access.
 
-Two modes are supported:
+Three modes are supported:
 
 - **Mode 1 (CommonUser program):** a symlink `dsarch -> pywrapper` runs `setuid_dsarch`
   as the common user.
@@ -31,6 +31,12 @@ Two modes are supported:
   runs any command as `<loginname>` via `pgstart.py`.  `<loginname>` can be any
   user that belongs to the same group as `PGLOG['COMMONUSER']`.  Execution is
   restricted to authorized callers (see `pgstart.py` below).
+- **Mode 3 (cmwrapper, callers outside the group):** a dedicated binary compiled
+  from `cmwrapper.c` and installed `4755` runs ONE fixed program as the common
+  user for any user on the machine, including users outside the common user's
+  group (see "cmwrapper" below).  With `-s|--simple` the same binary is installed
+  `755` with no setuid, which publishes ONE program of this environment to users
+  who have no environment of their own.
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -213,6 +219,63 @@ pywrapper-install -l|--link dsarch -s|--simple
 pywrapper-install -l|--link all -s|--simple   # or link all setuid_* entries at once
 ```
 
+### cmwrapper (Mode 3, for callers outside the CommonUser group)
+
+`pywrapper` is installed `4750`, so only members of the common user's group can
+execute it.  That group restriction is what makes it safe for `pywrapper` to pick
+the program to run from `basename(argv[0])`: anyone who can execute it can already
+reach every `setuid_*` entry in `bin/` just by naming the symlink differently.
+
+`cmwrapper` is for the opposite case — letting users who are **not** in the common
+user's group run one specific program as the common user.  It is installed `4755`,
+i.e. executable by everyone, so nothing about what it runs may come from the caller:
+
+- the absolute path of the script to exec, and the program name, are baked into the
+  binary at compile time, so it cannot be symlinked under another name to reach a
+  different program;
+- the environment is replaced with a fixed whitelist (`HOME`, `USER`, `LOGNAME`,
+  `TERM`, `LANG`, `TZ`, a fixed `PATH` and `PYTHONNOUSERSITE=1`), so `PYTHONPATH`,
+  `PYTHONHOME`, `LD_PRELOAD`, `LD_LIBRARY_PATH` and the `PGLOG` path variables
+  (`DSDHOME`, `DSSHOME`, `LOGPATH`, `COMMONUSER`, ...) cannot be used to run
+  arbitrary code, or redirect where files are written, as the common user.
+
+One binary is compiled per wrapped program:
+
+```bash
+# Install bin/gdexdrop as a 4755 binary that execs bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop
+
+# Same, but installed into a common area already on everyone's PATH:
+pywrapper-install -m|--cmlink gdexdrop -d|--destdir /glade/u/home/gdexdata/bin
+
+# Point it at a script somewhere other than bin/setuid_gdexdrop:
+pywrapper-install -m|--cmlink gdexdrop -t|--target /path/to/setuid_gdexdrop
+```
+
+Only wrap a program that does its own authorization and confines where it writes,
+such as `gdexdrop`, which checks its caller against an access list and copies only
+into the requested dataset directory.  Never wrap a general purpose program such as
+`gdexcp`: at `4755` that would let any user on the machine read or overwrite any
+file of the common user.
+
+### cmwrapper with no setuid, to publish a program of this environment
+
+Add `-s|--simple` to compile the binary `755` with no setuid bit.  Nothing runs as
+another user; the binary exists only so that users who do not have this environment,
+and cannot activate a venv or a conda environment, can still run one of its programs
+by name — `gdexls`, for example:
+
+```bash
+# Install /glade/u/apps/contrib/gdexls, a 755 binary that execs bin/gdexls:
+pywrapper-install -m|--cmlink gdexls -s|--simple -d|--destdir /glade/u/apps/contrib
+```
+
+Since there is no privilege change, sanitizing the environment would buy no security
+and would only break the caller's own settings, so the caller's environment is passed
+through except for `PYTHONPATH`, `PYTHONHOME` and `PYTHONSTARTUP`, which would send
+the program to another environment's modules.  The default `-t|--target` is
+`bin/PROGRAM` rather than `bin/setuid_PROGRAM`, and no `sudo` access is required.
+
 ## Runtime flow
 
 ```
@@ -220,6 +283,16 @@ user runs:  dsarch [args]
               |  (symlink -> pywrapper, setuid bit -> EUID=gdexdata)
 pywrapper.c:  execv(bin/setuid_dsarch, args)
 setuid_dsarch: calls dsarch:main() as gdexdata
+
+user runs:  gdexdrop [args]
+              |  (dedicated 4755 binary, setuid bit -> EUID=gdexdata)
+cmwrapper.c:  execve(bin/setuid_gdexdrop, args, sanitized env)
+setuid_gdexdrop: calls gdexdrop:main() as gdexdata
+
+user runs:  gdexls [args]
+              |  (dedicated 755 binary, no setuid, -DCMSIMPLE)
+cmwrapper.c:  execv(bin/gdexls, args)
+gdexls:       calls gdexls:main() as the calling user
 ```
 
 ## Github

{rda_python_setuid-3.0.0 → rda_python_setuid-3.0.2}/src/rda_python_setuid.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ MANIFEST.in
 README.md
 pyproject.toml
 src/rda_python_setuid/__init__.py
+src/rda_python_setuid/cmwrapper.c
 src/rda_python_setuid/install.py
 src/rda_python_setuid/install.usg
 src/rda_python_setuid/pgstart.py