From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gentoo-user+bounces-172207-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by finch.gentoo.org (Postfix) with ESMTPS id 36CB8138306
	for <garchives@archives.gentoo.org>; Wed, 13 Jul 2016 17:42:05 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id BCF9D21C253;
	Wed, 13 Jul 2016 17:41:58 +0000 (UTC)
Received: from mail.web-xs.org (mail.web-xs.org [148.251.4.204])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by pigeon.gentoo.org (Postfix) with ESMTPS id 5D95621C238
	for <gentoo-user@lists.gentoo.org>; Wed, 13 Jul 2016 17:41:57 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
	by mail.web-xs.org (Postfix) with ESMTP id 00CBD6EC4CD9
	for <gentoo-user@lists.gentoo.org>; Wed, 13 Jul 2016 19:41:56 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at mail.web-xs.org
Received: from mail.web-xs.org ([127.0.0.1])
	by localhost (mail.web-xs.org [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 2gJapVGdJBhR for <gentoo-user@lists.gentoo.org>;
	Wed, 13 Jul 2016 19:41:54 +0200 (CEST)
Received: from server-1.localdomain (p54A719F2.dip0.t-ipconnect.de [84.167.25.242])
	(Authenticated sender: lukas@der-erste-sinn.de)
	by mail.web-xs.org (Postfix) with ESMTPA id 57AFD6EC4CCF
	for <gentoo-user@lists.gentoo.org>; Wed, 13 Jul 2016 19:41:54 +0200 (CEST)
Received: from hal9000.localdomain (hal.localdomain [192.168.0.2])
	by server-1.localdomain (Postfix) with ESMTP id 2ECEC442
	for <gentoo-user@lists.gentoo.org>; Wed, 13 Jul 2016 19:41:54 +0200 (CEST)
Date: Wed, 13 Jul 2016 19:41:41 +0200
From: wabe <wabenbau@gmail.com>
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] executing a command as a nologin user
Message-ID: <20160713194141.54a86f10@hal9000.localdomain>
In-Reply-To: <b0f2934d-14ef-7fcc-3023-be23879ddf50@gmail.com>
References: <20160712034702.00000f6c@lxsbbs.eu>
 <578621B6.3080001@gmail.com>
 <b0f2934d-14ef-7fcc-3023-be23879ddf50@gmail.com>
Precedence: bulk
List-Post: <mailto:gentoo-user@lists.gentoo.org>
List-Help: <mailto:gentoo-user+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-user+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-user+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-user.gentoo.org>
X-BeenThere: gentoo-user@lists.gentoo.org
Reply-to: gentoo-user@lists.gentoo.org
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Archives-Salt: ebf55eac-5dc2-4ed3-bd44-c132b2931b1d
X-Archives-Hash: a2472a5a6d41bd43220c3e12631f2649

Fernando Rodriguez <cyklonite@gmail.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> On 07/13/2016 07:10 AM, Alan McKinnon wrote:
> > On 12/07/2016 03:47, jens w wrote:  
> >> .procmailrc
> >> :0 c
> >> * !^X-Loop: name@example.com  
> >> | formail -X "From:" | $HOME/bin/script.sh  
> >>
> >> procmail.log
> >> procmail: Executing " formail -X "From:" | $HOME/bin/script.sh
> >>
> >> for incoming mail, a script is executed. logfile has the same
> >> entry as it is in other users. but the script do nothing.
> >>
> >> How executing a command as a nologin user?
> >>  
> > 
> > 
> > You can't, not the way you are doing it.
> > You want to launch a shell script for the user, but the user's
> > shell is /sbin/nologin. This exits immediately without launching
> > the script.
> > 
> > Give the user a real shell.
> > 
> > Alan
> >   
> 
> I've been following this thread and thinking the same thing but
> wasn't sure.
> 
> What if you invoke the shell directly instead of the script, either:
> /bin/sh -c "<path to script>" or /bin/sh -c "$(cat <script>)"?
> 
> If procmail uses the system() call to launch the script it won't work
> but if it uses fork()/exec() or similar I think that it should work.

I don't know how procmail is launching scripts so I don't know if
that what I say now makes sense. :-)

I tested if another regular user (lets call him user1) can execute 
scripts that are owned by nologinuser. It works as long as the path 
and the script itself are readable and executable by user1.
If the script is writing stuff into /home/nologinuser then it is
also necessary that the home directory is writable by user1.

Of course user1 hasn't executed the script as nologinuser. I don't
know if procmail is doing so.

--
Regards
wabe