Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
X-Authentication-Warning: denzel.sciencetools.com: rtroy owned process doing -bs
Date: Tue, 23 Mar 2004 10:33:20 -0800 (PST)
From: Richard Troy <rtroy AT ScienceTools DOT com>
To: <cygwin AT cygwin DOT com>
Subject: Re: suid bit on executables?
In-Reply-To: <Pine.GSO.4.56.0403231209180.19995@slinky.cs.nyu.edu>
Message-ID: <Pine.LNX.4.33.0403231018540.1808-100000@denzel.sciencetools.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-IsSubscribed: yes



> Richard,
>
> FYI, Cygwin implements /dev/conin and /dev/conout, so, perhaps, the
> approach suggested in <http://cygwin.com/ml/cygwin/2004-03/msg00259.html>
> would be helpful (or something along those lines).

Hi Igor,

I tried man and apropos, and found nothing for conin or conout, but if I
understand what you're suggesting, you're saying I should try something
like the following:

The original command to use as a template (I take it this worked?):

cygrunsrv --install fetchmail --path /usr/bin/su.exe --args "-p -c
'/usr/bin/fetchmail --daemon 300 --nodetach </dev/conin 2>/dev/conout'
domain\\user" --env HOME=/home/user --termsig TERM --shutdown --type
manual --interactive

My interpretation of the above:

cygrunsrv --install <my_program> --path /usr/bin/su.exe --args
"-p -c '<path_to_my_program> <my_programs_args> </dev/conin 2>/dev/conout'
<my_domain>\\<privileged_user>" --env <my_progs_env_vars> --termsig TERM
--shutdown --type manual --interactive

Hmmm... Yes, this _seems_to_me_ to be exactly what I was hinting at when
Corinna suggested ssh instead. ... The above would be both better and
easier because there's no need for keys and no encryption overhead. Do I
understand that conin and conout redirect std-in and std-out to/from the
installed service to the caller of the service?

Also, you said:

> OTOH, once cygserver is in place, we'll have a working "su" (which is
> exactly what you want, right?).

But in the above cygrunsrv you call su! Yes, I know the executable is
there - in at least this example, does it work? Also, since there's an
ability to specify the user, maybe use the user flag, specify it
explicitly and ignore the su.exe?


Thanks for all your keystrokes!

Regards,
Richard

-- 
Richard Troy, Chief Scientist
Science Tools Corporation
rtroy AT ScienceTools DOT com, 510-567-9957, http://ScienceTools.com/


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/