imzhangwenrong/superpy

provide user impersonation on linux

GoogleCodeExporter opened this issue · 0 comments

Superpy currently supports user impersonation on windows but not linux.
This means that if you provide a user argument to ImpersonatingTask on
linux, it won't switch to the desired user (although things work fine on
windows).

I believe this is a pretty easy fix that can be handled using setuid,
setgid. The only potential drawback is that this means that superpy needs
to be run as root on linux so it can switch to the desired user. If we make
it so that superpy runs as root on linux, we should make it so that only
ImpersonatingTask objects can be run and make sure nobody can submit a task
to run as the current user. In contrast, on windows we currently use a
solution which does not require the superpy processes to be Administrator.

We could also try and make the windows and linux versions use analagous
implementations by trying to use cygwin's approach (see their detailed
discussion of windows and UNIX security at
http://www.cygwin.com/cygwin-ug-net/ntsec.html). For example, you can see
some example source code of how they deal with changing users at
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/winsup/cygwin/sec_auth.cc?annot
ate=1.25&cvsroot=src).



Original issue reported on code.google.com by emin.martinian on 30 Sep 2009 at 1:33