Il 04/01/2024 16:27, Greg Wooledge ha scritto:
On Thu, Jan 04, 2024 at 03:07:59PM +0100, Valerio Vanni wrote:
Il 03/01/2024 17:41, Greg Wooledge ha scritto:
The su command is not an ideal choice for this, in fact. The setpriv(1)
command is better suited for running programs as other user accounts,
without doing crazy PAM stuff like su does.
Can you explain better?
http://jdebp.info/FGA/dont-abuse-su-for-dropping-privileges.html
Thank you.
Now I'm trying this way:
-----
#!/bin/bash
case "$1" in
pre)
#code execution BEFORE sleeping/hibernating/suspending
kafpid=$(pgrep kaffeine)
kafuid=$(stat -c "%u" /proc/$kafpid)
kafgid=$(stat -c "%g" /proc/$kafpid)
kafdis=$(cat /proc/$kafpid/environ | tr '\0' '\n' | grep DISPLAY)
echo $kafuid > /temp/kafuid.txt
echo $kafgid > /temp/kafgid.txt
echo $kafdis > /temp/kafdis.txt
kaffeine_killed=$(/usr/bin/killall kaffeine 2>&1)
echo $kaffeine_killed > /temp/kafstate.txt
/usr/bin/sleep 2
/usr/sbin/rmmod cx23885
;;
post)
#code execution AFTER resuming
/usr/sbin/modprobe cx23885
/usr/bin/sleep 3
kaffeine_killed=$(cat /temp/kafstate.txt)
kafuid=$(cat /temp/kafuid.txt)
kafgid=$(cat /temp/kafgid.txt)
kafdis=$(cat /temp/kafdis.txt)
if [[ $kaffeine_killed == "" ]]; then
setpriv --reuid "$kafuid" --regid "$kafgid" --init-groups
--reset-env \
env XDG_RUNTIME_DIR=/run/user/"$kafuid" $kafdis
XDG_CURRENT_DESKTOP=KDE \
/usr/bin/kaffeine --lastchannel >/dev/null 2>&1
fi
rm -f /temp/kafstate.txt
rm -f /temp/kafuid.txt
rm -f /temp/kafgid.txt
rm -f /temp/kafdis.txt
;;
esac
-----
Uid, gid and display are saved and restored, so it can works also for
other users and x servers.
But with setpriv kaffeine was complaining it couldn't find .config/,
database etc and so it wasn't able to start. It seems that was ignorming
original user's home and tried to access root home.
Adding the parameter --reset-env seems to fix, kaffeine restarts.
But, after some minutes, it closes. I don't understand why.
-Kaffeine launched by hand stays up
-Kaffeine restored with "su" method stays up
-Kaffeine restored with "setpriv" method lasts only some minute
