CentOS - Oct 2013 - setuid or other ideas

Everyone,

I am working on a Centos 5.9 system.  I have an need to be able to
activate a piece of software from /etc/smrsh that is activated when
sendmail delivers the e-mail to this piece of software.  I would like
this piece of software to take on the user and group identities that are
different than 'mail' which is what happens now.  I want to use a user
and group that is not root), so that the piece of software will be able
to write (concatenate) to a file.

I have never used setuid, but it appears that this will only allow a
piece of software to be set to root.  I really do not want to give that
kind of privilege to this piece of software.

Any ideas? 
-- 
Greg Ennis
PoMec Corporation
www.PoMec.Net

On 10/14/2013 02:31 PM, Gregory P. Ennis wrote:
> Everyone,
>
> I am working on a Centos 5.9 system.  I have an need to be able to
> activate a piece of software from /etc/smrsh that is activated when
> sendmail delivers the e-mail to this piece of software.  I would like
> this piece of software to take on the user and group identities that are
> different than 'mail' which is what happens now.  I want to use a
user
> and group that is not root), so that the piece of software will be able
> to write (concatenate) to a file.
>
> I have never used setuid, but it appears that this will only allow a
> piece of software to be set to root.  I really do not want to give that
> kind of privilege to this piece of software.
>
> Any ideas?
I've done lots of operations from /etc/smrsh under sendmail. I can't say
I've ever used setuid for this type of work; it may well suffice. Now in 
my case with sendmail, the scripts run as the user receiving the email 
locally, so I don't need to do any of the below. I simply define the 
account that I want to run the script as the recipient of the message 
and it's all done.

I'd suggest to run sudo and make an entry in /etc/sudoers. You want to 
be paranoid around any publicly visible service like email but an entry 
like this might work in /etc/sudoers:

mail    ALL=(user2) NOPASSWD: /usr/local/script.to.run.sh
Defaults:mail !requiretty

Again, I'm not sure why you are seeing this run as the "mail" user
unless that is the name of the local account, sendmail runs these kinds 
of scripts as the user receiving the messages. In which case, if my user 
was "taxinfo" it would look like

taxinfo    ALL=(user2) NOPASSWD: /usr/local/script.to.run.sh
Defaults:taxinfo !requiretty

Note that the last line (Defaults...)  is probably needed because 
there's not an actual terminal involved when processing a background 
script. Try without and see if it works. Then, in /etc/smrsh/received.sh 
you have

#! /bin/sh
/usr/bin/sudo -u taxinfo /usr/local/script.to.run.sh;


And in your .forward file: (don't forget to chmod 600 this file)
| /etc/smrsh/received.sh

Good luck!

On Mon, 14 Oct 2013, Gregory P. Ennis wrote:
> I have never used setuid, but it appears that this will only allow a
> piece of software to be set to root.  I really do not want to give that
> kind of privilege to this piece of software.
IIRC suid sets the effective user to the owner of the file.
If ceres runs a setuid program owned by series,
the effective user will become series.
There is also a system call to make effective owner the actual owner.
suid root programs often use it after they have glommed
onto all the necessary resources only availale to root.

-- 
Michael   hennebry at web.cs.ndsu.NoDak.edu
"On Monday, I'm gonna have to tell my kindergarten class,
whom I teach not to run with scissors,
that my fiance ran me through with a broadsword."  --  Lily