Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-16 Thread Alasdair G Kergon
On Fri, Nov 16, 2018 at 02:43:10PM +0100, Christoph Pleger wrote: > I get security by checking the real user id at the beginning of the > program and aborting the program if that uid does not belong to the only > user who is allowed to run the program. Sounds familiar. Shall I tell you one o

Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-16 Thread Roger Heflin
Why aren't you just using sudo for this? On Fri, Nov 16, 2018 at 11:14 AM Christoph Pleger wrote: > > Hello, > > > How do you plan to 'authorize' passed command line options ?? > > My program has no command line options. It just takes PAM_USER from PAM > environment and creates a logical volume /d

Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-16 Thread Christoph Pleger
Hello, How do you plan to 'authorize' passed command line options ?? My program has no command line options. It just takes PAM_USER from PAM environment and creates a logical volume /dev/vg1/$PAM_USER, creates a filesystem and changes directory permissions of the top directory of the new fi

Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-16 Thread Zdenek Kabelac
Dne 16. 11. 18 v 14:43 Christoph Pleger napsal(a): Hello, Let's stop there.  The fact you're asking a question about setuid suggests you don't understand enough to be able to use it safely. I get security by checking the real user id at the beginning of the program and aborting the program i

Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-16 Thread Christoph Pleger
Hello, Let's stop there. The fact you're asking a question about setuid suggests you don't understand enough to be able to use it safely. I get security by checking the real user id at the beginning of the program and aborting the program if that uid does not belong to the only user who is