Re: [gentoo-user] executing a command as a nologin user

[Fernando Rodriguez <cyklonite@gmail.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 07/13/2016 01:41 PM, wabe wrote:
> Fernando Rodriguez <cyklonite@gmail.com> wrote:
> 
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA256
>>
>> On 07/13/2016 07:10 AM, Alan McKinnon wrote:
>>> On 12/07/2016 03:47, jens w wrote:  
>>>> .procmailrc
>>>> :0 c
>>>> * !^X-Loop: name@example.com  
>>>> | formail -X "From:" | $HOME/bin/script.sh  
>>>>
>>>> procmail.log
>>>> procmail: Executing " formail -X "From:" | $HOME/bin/script.sh
>>>>
>>>> for incoming mail, a script is executed. logfile has the same
>>>> entry as it is in other users. but the script do nothing.
>>>>
>>>> How executing a command as a nologin user?
>>>>  
>>>
>>>
>>> You can't, not the way you are doing it.
>>> You want to launch a shell script for the user, but the user's
>>> shell is /sbin/nologin. This exits immediately without launching
>>> the script.
>>>
>>> Give the user a real shell.
>>>
>>> Alan
>>>   
>>
>> I've been following this thread and thinking the same thing but
>> wasn't sure.
>>
>> What if you invoke the shell directly instead of the script, either:
>> /bin/sh -c "<path to script>" or /bin/sh -c "$(cat <script>)"?
>>
>> If procmail uses the system() call to launch the script it won't work
>> but if it uses fork()/exec() or similar I think that it should work.
> 
> I don't know how procmail is launching scripts so I don't know if
> that what I say now makes sense. :-)
> 
> I tested if another regular user (lets call him user1) can execute 
> scripts that are owned by nologinuser. It works as long as the path 
> and the script itself are readable and executable by user1.
> If the script is writing stuff into /home/nologinuser then it is
> also necessary that the home directory is writable by user1.
> 
> Of course user1 hasn't executed the script as nologinuser. I don't
> know if procmail is doing so.
> 
> --
> Regards
> wabe
> 

Yes, you can execute any scripts as long as you have permissions. A program
can use the exec() family of functions to do that. But if the program calls
the system() function or similar it will try to use the user shell to execute
the command. If the shell is nologin it will refuse to do so.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXiAHpAAoJEPbOFX/5UlwciFIQAIjuF7FyCK5LSfJDuaF9TD4F
nCDABuUVQzfAKX6EneNu40EPWsgs86xFjJqOI1tDAjC0lBWzKIZnX72fR/vSylHP
qCTPCNJzFCaZ6ofjcUFfwtFDLxR2esgyCD4YUxHkQlATutzmx9kPwT/j7nxOILr0
udGYZVxJqfLLm6KL4NHOYwBe2rMMlXVQpwLoqfGffVJnJpQokZfYhgNYOaibvtMz
K8rO+9EqD4w6JBiRZOI2LVZ/+mCz/jwrLPToNaeENI2M9+kzzRalOecbQkghDSvT
rCHdgllPQJlL88I1ZaBIYcL9cbuWKrwxQDjpF5WtOlD/E9GBT4pI2IaDvIyCBCrb
lo3gWxxwZUHhIY491Y0f+BxsFsf8K2isu3I98+1zIhAXyDV5RKQGnHeRfdt0dpLs
YVko24UHw4MV+6byC1pgQ3NUHgq/tQ4adzLJRnxuPq6qxVdyCcs1IQglqLfvUGFV
H6EaJNFhOP9SyGtlAIBBCD3rRnLeWHKM01hcm2uUqgpH7WujWekTY1Mv8HOesXTd
htpvRaC8DghUz6rxK7+qsX5fm+FTQmx8v9yrPFLUvMmkdsiLUEZJfgySwlvYoBIg
7JHpPSI5lASuGkYoDA2mExPZmVKdmHBH2rMbrrZzEun5FFJMsPNa0yevcfs1XHdJ
GOAGe/y4+oMib0gkFKde
=T1mF
-----END PGP SIGNATURE-----