Re: [gentoo-user] executing a command as a nologin user

[wabe <wabenbau@gmail.com>]

Fernando Rodriguez <cyklonite@gmail.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> On 07/13/2016 07:10 AM, Alan McKinnon wrote:
> > On 12/07/2016 03:47, jens w wrote:  
> >> .procmailrc
> >> :0 c
> >> * !^X-Loop: name@example.com  
> >> | formail -X "From:" | $HOME/bin/script.sh  
> >>
> >> procmail.log
> >> procmail: Executing " formail -X "From:" | $HOME/bin/script.sh
> >>
> >> for incoming mail, a script is executed. logfile has the same
> >> entry as it is in other users. but the script do nothing.
> >>
> >> How executing a command as a nologin user?
> >>  
> > 
> > 
> > You can't, not the way you are doing it.
> > You want to launch a shell script for the user, but the user's
> > shell is /sbin/nologin. This exits immediately without launching
> > the script.
> > 
> > Give the user a real shell.
> > 
> > Alan
> >   
> 
> I've been following this thread and thinking the same thing but
> wasn't sure.
> 
> What if you invoke the shell directly instead of the script, either:
> /bin/sh -c "<path to script>" or /bin/sh -c "$(cat <script>)"?
> 
> If procmail uses the system() call to launch the script it won't work
> but if it uses fork()/exec() or similar I think that it should work.

I don't know how procmail is launching scripts so I don't know if
that what I say now makes sense. :-)

I tested if another regular user (lets call him user1) can execute 
scripts that are owned by nologinuser. It works as long as the path 
and the script itself are readable and executable by user1.
If the script is writing stuff into /home/nologinuser then it is
also necessary that the home directory is writable by user1.

Of course user1 hasn't executed the script as nologinuser. I don't
know if procmail is doing so.

--
Regards
wabe