From: Ken Bloom <kbloom@...>
Date: 2008-02-03T10:39:59+09:00
Subject: Re: Temporarily dropping root access

On Fri, 01 Feb 2008 16:12:18 -0500, Daniel Berger wrote:

> On Feb 1, 1:05 pm, MenTaLguY <men...@rydia.net> wrote:
>> On Sat, 2 Feb 2008 04:23:02 +0900, Daniel Berger <djber...@gmail.com>
>> wrote:
>> > Hi all,
>>
>> > Say I've got a C extension with two rake tasks - 'build' and
>> > 'install'. For the build task, if currently being run as root, I
>> > would like it to drop down to, say, the 'nobody' user. Obviously, I'm
>> > only talking about Unix here.
>>
>> Generally speaking, you should be able to use setreuid to set the
>> effective UID to 'nobody' while keeping the real UID as root.
>>
>> (Actually 'nobody' may not be a good choice depending on the Unix
>> flavor; I believe it is something of a special case on HP-UX for
>> example)
> 
> Oh, and just curious, is there ever a time when you *would* want to
> build as root?

You most likely would not, but you are forced to when installing a 
rubygem that built a native module. Another common example of when people 
build occurs frequently when they have to build Linux kernel modules. For 
example, I believe Debian's module-assistant tool builds modules as root, 
and the ATI driver's (fglrx) installer does, and I believe that when you 
use a pbuilder chroot (an environment that mimics the Debian build 
daemons), you're building as root.

-- 
Ken (Chanoch) Bloom. PhD candidate. Linguistic Cognition Laboratory.
Department of Computer Science. Illinois Institute of Technology.
http://www.iit.edu/~kbloom1/