From: Andre Nathan <andre@...>
Date: 2005-04-04T05:59:33+09:00
Subject: Re: Reducing Permissions

Jon Raphaelson said:
> Is there a way to programtically reduce permissions
[...]
> Any ideas? Thanks!

I use this in one of my projects:

  def drop_privileges(user='nobody')
    pw = Etc::getpwnam(user)
    begin
      Dir.chdir(pw.dir)
      Dir.chroot(pw.dir)
      Dir.chdir('/')
    rescue => e
      puts "Cannot chroot to #{pw.dir}: #{e}"
      exit
    end

    Process::initgroups(user, pw.gid)
    begin
      Process::Sys::setresgid(pw.gid, pw.gid, pw.gid)
      Process::Sys::setresuid(pw.uid, pw.uid, pw.uid)
    rescue NotImplementedError
      # Try something portable... might not be as secure though
      Process::Sys::setegid(pw.gid)
      Process::Sys::setgid(pw.gid)
      Process::Sys::setuid(pw.uid)
    rescue => e
      puts "Cannot drop privileges: #{e}"
      exit
    end
  end

Tested on *BSD and linux. At least NetBSD doesn't implement the
setres* system calls (which aren't defined by POSIX), so I added the
rescue for NotImplementedError.

HTH,
Andre