rda-python-setuid 3.0.1__tar.gz → 3.0.3__tar.gz

{rda_python_setuid-3.0.1/src/rda_python_setuid.egg-info → rda_python_setuid-3.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 3.0.1
+Version: 3.0.3
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -34,7 +34,9 @@ Three modes are supported:
 - **Mode 3 (cmwrapper, callers outside the group):** a dedicated binary compiled
   from `cmwrapper.c` and installed `4755` runs ONE fixed program as the common
   user for any user on the machine, including users outside the common user's
-  group (see "cmwrapper" below).
+  group (see "cmwrapper" below).  With `-s|--simple` the same binary is installed
+  `755` with no setuid, which publishes ONE program of this environment to users
+  who have no environment of their own.
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -256,6 +258,24 @@ into the requested dataset directory.  Never wrap a general purpose program such
 `gdexcp`: at `4755` that would let any user on the machine read or overwrite any
 file of the common user.
 
+### cmwrapper with no setuid, to publish a program of this environment
+
+Add `-s|--simple` to compile the binary `755` with no setuid bit.  Nothing runs as
+another user; the binary exists only so that users who do not have this environment,
+and cannot activate a venv or a conda environment, can still run one of its programs
+by name — `gdexls`, for example:
+
+```bash
+# Install /glade/u/apps/contrib/gdexls, a 755 binary that execs bin/gdexls:
+pywrapper-install -m|--cmlink gdexls -s|--simple -d|--destdir /glade/u/apps/contrib
+```
+
+Since there is no privilege change, sanitizing the environment would buy no security
+and would only break the caller's own settings, so the caller's environment is passed
+through except for `PYTHONPATH`, `PYTHONHOME` and `PYTHONSTARTUP`, which would send
+the program to another environment's modules.  The default `-t|--target` is
+`bin/PROGRAM` rather than `bin/setuid_PROGRAM`, and no `sudo` access is required.
+
 ## Runtime flow
 
 ```
@@ -268,6 +288,11 @@ user runs:  gdexdrop [args]
               |  (dedicated 4755 binary, setuid bit -> EUID=gdexdata)
 cmwrapper.c:  execve(bin/setuid_gdexdrop, args, sanitized env)
 setuid_gdexdrop: calls gdexdrop:main() as gdexdata
+
+user runs:  gdexls [args]
+              |  (dedicated 755 binary, no setuid, -DCMSIMPLE)
+cmwrapper.c:  execv(bin/gdexls, args)
+gdexls:       calls gdexls:main() as the calling user
 ```
 
 ## Github

{rda_python_setuid-3.0.1 → rda_python_setuid-3.0.3}/README.md

@@ -18,7 +18,9 @@ Three modes are supported:
 - **Mode 3 (cmwrapper, callers outside the group):** a dedicated binary compiled
   from `cmwrapper.c` and installed `4755` runs ONE fixed program as the common
   user for any user on the machine, including users outside the common user's
-  group (see "cmwrapper" below).
+  group (see "cmwrapper" below).  With `-s|--simple` the same binary is installed
+  `755` with no setuid, which publishes ONE program of this environment to users
+  who have no environment of their own.
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -240,6 +242,24 @@ into the requested dataset directory.  Never wrap a general purpose program such
 `gdexcp`: at `4755` that would let any user on the machine read or overwrite any
 file of the common user.
 
+### cmwrapper with no setuid, to publish a program of this environment
+
+Add `-s|--simple` to compile the binary `755` with no setuid bit.  Nothing runs as
+another user; the binary exists only so that users who do not have this environment,
+and cannot activate a venv or a conda environment, can still run one of its programs
+by name — `gdexls`, for example:
+
+```bash
+# Install /glade/u/apps/contrib/gdexls, a 755 binary that execs bin/gdexls:
+pywrapper-install -m|--cmlink gdexls -s|--simple -d|--destdir /glade/u/apps/contrib
+```
+
+Since there is no privilege change, sanitizing the environment would buy no security
+and would only break the caller's own settings, so the caller's environment is passed
+through except for `PYTHONPATH`, `PYTHONHOME` and `PYTHONSTARTUP`, which would send
+the program to another environment's modules.  The default `-t|--target` is
+`bin/PROGRAM` rather than `bin/setuid_PROGRAM`, and no `sudo` access is required.
+
 ## Runtime flow
 
 ```
@@ -252,6 +272,11 @@ user runs:  gdexdrop [args]
               |  (dedicated 4755 binary, setuid bit -> EUID=gdexdata)
 cmwrapper.c:  execve(bin/setuid_gdexdrop, args, sanitized env)
 setuid_gdexdrop: calls gdexdrop:main() as gdexdata
+
+user runs:  gdexls [args]
+              |  (dedicated 755 binary, no setuid, -DCMSIMPLE)
+cmwrapper.c:  execv(bin/gdexls, args)
+gdexls:       calls gdexls:main() as the calling user
 ```
 
 ## Github

{rda_python_setuid-3.0.1 → rda_python_setuid-3.0.3}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rda_python_setuid"
-version = "3.0.1"
+version = "3.0.3"
 authors = [
   { name="Zaihua Ji", email="zji@ucar.edu" },
 ]

{rda_python_setuid-3.0.1 → rda_python_setuid-3.0.3}/src/rda_python_setuid/cmwrapper.c

@@ -33,6 +33,15 @@
  *    # Compile and install bin/PROGRAM as a 4755 setuid binary owned by CommonUser:
  *    pywrapper-install -m|--cmlink PROGRAM [-n|--username CommonUser] [-e|--envhome $ENVHOME]
  *
+ *    # Compile it 755 with no setuid, to publish a program of an environment to
+ *    # users who do not have that environment (-DCMSIMPLE):
+ *    pywrapper-install -m|--cmlink PROGRAM -s|--simple [-d|--destdir DIR]
+ *
+ *    With -DCMSIMPLE there is no privilege change, so the caller's environment is
+ *    kept except for PYTHONPATH, PYTHONHOME and PYTHONSTARTUP, which would send the
+ *    program to another environment's modules.  Sanitizing the rest would buy no
+ *    security and would only break the caller's own settings.
+ *
  \***************************************************************************************/
 
 #include <unistd.h>
@@ -47,16 +56,39 @@
 #error "CMEXEC must be defined at compile time, e.g. -DCMEXEC=\"/env/bin/setuid_gdexdrop\""
 #endif
 
+#ifdef CMSIMPLE
+
+/* Python variables of the caller that would make the wrapped program load modules
+   from somewhere other than its own environment. */
+static const char *dropvars[] = {"PYTHONPATH", "PYTHONHOME", "PYTHONSTARTUP", NULL};
+
+#else
+
 #define CMPATH "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
 
 /* Environment variables passed through from the caller.  Everything else is
    dropped; in particular every PYTHON*, LD_* and PGLOG path variable. */
 static const char *keepvars[] = {"HOME", "USER", "LOGNAME", "TERM", "LANG", "TZ", NULL};
 
+#endif
+
 /* main program */
 int main(int argc, char *argv[]) {
    (void)argc;
 
+#ifdef CMSIMPLE
+
+   /* No privilege change, so sanitizing the environment buys no security and can
+      only break the caller's own settings.  Only the Python variables that would
+      send the program to another environment's modules are dropped. */
+   int i;
+
+   for(i = 0; dropvars[i] != NULL; i++) unsetenv(dropvars[i]);
+   argv[0] = (char *)CMPROG;
+   execv(CMEXEC, argv);
+
+#else
+
    char *envp[16];
    char *value, *entry;
    size_t len;
@@ -80,6 +112,9 @@ int main(int argc, char *argv[]) {
 
    argv[0] = (char *)CMPROG;   /* the program identifies itself by this name */
    execve(CMEXEC, argv, envp);
-   perror(CMEXEC);   /* execve only returns on error */
+
+#endif
+
+   perror(CMEXEC);   /* exec only returns on error */
    exit(1);
 }

{rda_python_setuid-3.0.1 → rda_python_setuid-3.0.3}/src/rda_python_setuid/install.py

@@ -36,6 +36,10 @@
 #   #    group can run one fixed program as CommonUser:
 #   pywrapper-install -m myprog [-t SCRIPT] [-d DESTDIR] [-n gdexdata] [-e $ENVHOME]
 #
+#   # 6b. Compile it 755 with no setuid, to publish a program of this environment to
+#   #     users who do not have the environment at all:
+#   pywrapper-install -m myprog -s [-t SCRIPT] [-d DESTDIR] [-e $ENVHOME]
+#
 # Convention for wrapped programs:
 #   The target package must register its connector entry point with a setuid_ prefix:
 #      [project.scripts]
@@ -93,7 +97,7 @@ def main():
    )
    parser.add_argument(
       '-s', '--simple', action='store_true',
-      help="Simple install: create symlink PROGRAM -> setuid_PROGRAM, skipping setuid (use with -l/--link)"
+      help="Simple install, skipping setuid: symlink PROGRAM -> setuid_PROGRAM with -l/--link, or a 755 cmwrapper binary with -m/--cmlink"
    )
    group = parser.add_mutually_exclusive_group()
    group.add_argument(
@@ -110,7 +114,7 @@ def main():
    )
    group.add_argument(
       '-m', '--cmlink', metavar='PROGRAM',
-      help="Compile a dedicated 4755 cmwrapper binary for PROGRAM, so users outside the CommonUser group can run it (Mode 3)"
+      help="Compile a dedicated 4755 cmwrapper binary for PROGRAM, so users outside the CommonUser group can run it (Mode 3); add -s/--simple for a 755 binary with no setuid"
    )
    group.add_argument(
       '-u', '--update', action='store_true',
@@ -118,7 +122,7 @@ def main():
    )
    parser.add_argument(
       '-t', '--target', default=None,
-      help="Absolute path of the python script a cmwrapper binary execs (default: BINDIR/setuid_PROGRAM; use with -m/--cmlink)"
+      help="Absolute path of the python script a cmwrapper binary execs (default: BINDIR/setuid_PROGRAM, or BINDIR/PROGRAM with -s/--simple; use with -m/--cmlink)"
    )
    parser.add_argument(
       '-d', '--destdir', default=None,
@@ -233,10 +237,15 @@ def main():
       # 4755, so users outside the CommonUser group can run it.  The program path is
       # baked in at compile time and the environment is sanitized by cmwrapper.c, so
       # no symlink under another name can reach a different program.
+      # With -s/--simple the binary is 755 with no setuid, which publishes a program
+      # of this environment to users who do not have the environment at all.
       if not re.match(r'^\w+$', args.cmlink):
          print("Error: invalid program name '{}', expecting word characters only.".format(args.cmlink))
          sys.exit(1)
-      script = args.target if args.target else os.path.join(bindir, 'setuid_' + args.cmlink)
+      if args.target:
+         script = args.target
+      else:
+         script = os.path.join(bindir, args.cmlink if args.simple else 'setuid_' + args.cmlink)
       if not (os.path.isabs(script) and re.match(r'^[\w/.-]+$', script)):
          print("Error: {} of -t/--target must be an absolute path of word characters, '/', '.' and '-'.".format(script))
          sys.exit(1)
@@ -245,15 +254,36 @@ def main():
          sys.exit(1)
       destdir = args.destdir if args.destdir else bindir
       target = os.path.join(destdir, args.cmlink)
+      if os.path.abspath(target) == os.path.abspath(script):
+         print("Error: the binary {} would overwrite the script it execs; give -d/--destdir or -t/--target.".format(target))
+         sys.exit(1)
       src = get_c_source('cmwrapper.c')
       src_dest = os.path.join(bindir, 'cmwrapper.c')
       shutil.copy(src, src_dest)
       print("Copied: {}".format(src_dest))
-      run(['sudo', '-u', args.username, 'gcc',
-           '-DCMPROG="{}"'.format(args.cmlink), '-DCMEXEC="{}"'.format(script),
-           '-o', target, src_dest])
-      run(['sudo', '-u', args.username, 'chmod', '4755', target])
-      print("Installed: {} (setuid, owned by {}, execs {})".format(target, args.username, script))
+      cmd = ['gcc', '-DCMPROG="{}"'.format(args.cmlink), '-DCMEXEC="{}"'.format(script)]
+      if args.simple: cmd.append('-DCMSIMPLE')
+      prefix = [] if args.simple else ['sudo', '-u', args.username]
+      mode = '755' if args.simple else '4755'
+      # Compile to a temporary file and copy it onto the target, rather than letting
+      # gcc write the target directly: gcc recreates the file, which hands ownership
+      # of a binary in a shared common area to whoever recompiled it last.  'cp'
+      # writes through the file already there, so its owner, group and mode survive,
+      # and the mode is only refreshed when it is ours to change.
+      tmpout = target + '.new'
+      run(prefix + cmd + ['-o', tmpout, src_dest])
+      run(prefix + ['chmod', mode, tmpout])
+      if os.path.exists(target):
+         owned = not args.simple or os.stat(target).st_uid == os.geteuid()
+         run(prefix + ['cp', tmpout, target])
+         run(prefix + ['rm', '-f', tmpout])
+         if owned: run(prefix + ['chmod', mode, target])
+      else:
+         run(prefix + ['mv', tmpout, target])
+      if args.simple:
+         print("Installed: {} (no setuid, execs {})".format(target, script))
+      else:
+         print("Installed: {} (setuid, owned by {}, execs {})".format(target, args.username, script))
 
    elif args.update:
       # Update an existing installation: recompile pywrapper and reinstall all setuid binaries

{rda_python_setuid-3.0.1 → rda_python_setuid-3.0.3}/src/rda_python_setuid/install.usg

@@ -6,7 +6,8 @@
                           ( -c|--compile
                           | -p|--pgstart
                           | -l|--link PROGRAM|all [-s|--simple]
-                          | -m|--cmlink PROGRAM [-t|--target SCRIPT] [-d|--destdir DIR]
+                          | -m|--cmlink PROGRAM [-s|--simple] [-t|--target SCRIPT]
+                                                 [-d|--destdir DIR]
                           | -u|--update )
 
  Run pywrapper-install with no arguments to display this user guide.  Exactly
@@ -66,9 +67,18 @@
           as gdexcp, which would let any user on the machine read or overwrite
           any file of the common user.
 
+          Add -s/--simple to compile the binary 755 with no setuid, which is how
+          a program of this environment is published to users who do not have the
+          environment at all, such as gdexls.  There is no privilege change, so
+          the caller's environment is kept except for PYTHONPATH, PYTHONHOME and
+          PYTHONSTARTUP, which would send the program to another environment's
+          modules.  The default -t/--target is then bin/PROGRAM, and no sudo
+          access to USER is needed.
+
       - Option -t or --target SCRIPT (use with -m/--cmlink)
           Absolute path of the python script the cmwrapper binary execs.
-          Defaults to bin/setuid_PROGRAM of the environment.
+          Defaults to bin/setuid_PROGRAM of the environment, or to bin/PROGRAM
+          with -s/--simple.
 
       - Option -d or --destdir DIR (use with -m/--cmlink)
           Directory to install the cmwrapper binary into, typically a common area
@@ -82,11 +92,13 @@
           reinstalls every pgstart_* binary from update_tmp.  Use -n/--username to
           specify the gdex common user (default: gdexdata).
 
-      - Option -s or --simple (use with -l/--link)
-          Simple install: create a symlink PROGRAM -> setuid_PROGRAM directly,
-          skipping the setuid mechanism entirely.  The program runs as the current
-          user with no privilege change.  -n/--username is not required with this option.
-          Useful for users who do not need or cannot set up the setuid wrapper.
+      - Option -s or --simple (use with -l/--link or -m/--cmlink)
+          Simple install: skip the setuid mechanism entirely, so that the program
+          runs as the current user with no privilege change.  -n/--username is not
+          required with this option.  With -l/--link, a symlink PROGRAM ->
+          setuid_PROGRAM is created for users who do not need or cannot set up the
+          setuid wrapper; with -m/--cmlink, a 755 cmwrapper binary is compiled for
+          users who do not have this environment at all.
 
  Convention for wrapped programs:
    Any Python package whose program is to be run via pywrapper must:
@@ -200,3 +212,7 @@
    9. Let users outside the gdexdata group run gdexdrop as gdexdata, installing
       the 4755 binary into a common area on everyone's PATH:
          pywrapper-install -m gdexdrop -d /glade/u/home/gdexdata/bin
+
+  10. Publish gdexls of this environment to users who have no environment of
+      their own, with no setuid and no privilege change:
+         pywrapper-install -m gdexls -s -d /glade/u/apps/contrib

{rda_python_setuid-3.0.1 → rda_python_setuid-3.0.3/src/rda_python_setuid.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rda_python_setuid
-Version: 3.0.1
+Version: 3.0.3
 Summary: RDA Python Package to setuid for program executions as an effective or common user
 Author-email: Zaihua Ji <zji@ucar.edu>
 Project-URL: Homepage, https://github.com/NCAR/rda-python-setuid
@@ -34,7 +34,9 @@ Three modes are supported:
 - **Mode 3 (cmwrapper, callers outside the group):** a dedicated binary compiled
   from `cmwrapper.c` and installed `4755` runs ONE fixed program as the common
   user for any user on the machine, including users outside the common user's
-  group (see "cmwrapper" below).
+  group (see "cmwrapper" below).  With `-s|--simple` the same binary is installed
+  `755` with no setuid, which publishes ONE program of this environment to users
+  who have no environment of their own.
 
 Two Python entry points are packaged alongside the C wrapper:
 
@@ -256,6 +258,24 @@ into the requested dataset directory.  Never wrap a general purpose program such
 `gdexcp`: at `4755` that would let any user on the machine read or overwrite any
 file of the common user.
 
+### cmwrapper with no setuid, to publish a program of this environment
+
+Add `-s|--simple` to compile the binary `755` with no setuid bit.  Nothing runs as
+another user; the binary exists only so that users who do not have this environment,
+and cannot activate a venv or a conda environment, can still run one of its programs
+by name — `gdexls`, for example:
+
+```bash
+# Install /glade/u/apps/contrib/gdexls, a 755 binary that execs bin/gdexls:
+pywrapper-install -m|--cmlink gdexls -s|--simple -d|--destdir /glade/u/apps/contrib
+```
+
+Since there is no privilege change, sanitizing the environment would buy no security
+and would only break the caller's own settings, so the caller's environment is passed
+through except for `PYTHONPATH`, `PYTHONHOME` and `PYTHONSTARTUP`, which would send
+the program to another environment's modules.  The default `-t|--target` is
+`bin/PROGRAM` rather than `bin/setuid_PROGRAM`, and no `sudo` access is required.
+
 ## Runtime flow
 
 ```
@@ -268,6 +288,11 @@ user runs:  gdexdrop [args]
               |  (dedicated 4755 binary, setuid bit -> EUID=gdexdata)
 cmwrapper.c:  execve(bin/setuid_gdexdrop, args, sanitized env)
 setuid_gdexdrop: calls gdexdrop:main() as gdexdata
+
+user runs:  gdexls [args]
+              |  (dedicated 755 binary, no setuid, -DCMSIMPLE)
+cmwrapper.c:  execv(bin/gdexls, args)
+gdexls:       calls gdexls:main() as the calling user
 ```
 
 ## Github