Geek Answers Handbook

Set effective Perl group id

I have problems with file permissions that I would like to solve without resorting to making everything accessible to the whole world.

I am writing files in NetApp SAN. The directory that I write belongs to the user develand has a group develwith permissions to write groups ( 0775). The username I am writing is in groups usernameand devel.

The problem is that the SAN only checks the first group, so I get permission. If I use the newgrpor commands sgto change my group to devel, then I can write to the directory.

The script trying to write is written in Perl, but it is started remotely from another machine using ssh and some bash scripts.

I can’t change the target directory in the group username, because there are other developers, and they are in different groups (but we all share the group devel).

I can’t make the Perl script setgid myself, because we run different environments (devel, test, qa, production, etc.) with the corresponding groups, and I don’t want to control the file permission bits at this level.

I cannot use the POSIX function setgidfrom the Perl script because it does not start with root privileges (and I have no way to ever get root), so I get permission. Assignment $)also $(gives the same result.

newgrp bash, newgrp , ( , ).

newgrp, Perl script, Perl script ssh-. script "" , , newgrp .

sg, . , . , ssh, "$@" bash. , process start process stop, process script ssh , "$@". , , , .

, : - , Perl bash? sg?

+5
1

Perl script :

if ( 0+$( != DEVEL_GROUP_ID ) { # primary group isn't devel
  my(@reinvoke) = ($0, map {quotemeta} @ARGV);
  exec('/usr/bin/sg', 'devel', "@reinvoke");
  die("/usr/bin/sg not found!  Can't change group!");
}

, Perl sg.

+3

More articles:


All Articles