Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do I run a specific program with root privileges (Ubuntu OS) when no sudo user is logged into the system? The program needs root privileges to function correctly. A normal user shouldn't be able to shutdown this process. For example, I have two users, Admin and Client; The program should start only when the client logs into the system. It needs root privileges and the Client shouldn't be able to shut this process down.

share|improve this question
add comment

2 Answers

There are a few ways to do this. Ubuntu's graphical login is provided by GDM (or KDM if you're using Kubuntu). GDM is started by the Upstart subsystem.

The startup process follows these steps:

  1. System boots. Upstart starts services, including GDM (/etc/init/gdm).
  2. GDM starts, initializes the X-server (/etc/gdm/Init/*), and presents the GUI login window.
  3. A user logs in.
    1. PAM authorization happens (/etc/pam.d/gdm)
    2. GDM runs PostLogin script (/etc/gdm/PostLogin/*).
    3. GDM runs PreSession script (/etc/gdm/PreSession/*).
    4. GDM runs Xsession and xinit scripts
      (/etc/gdm/Xsession, /etc/X11/xinit/xinitrc.d/*, /etc/X11/Xsession, /etc/X11/Xsession.d/*)
  4. The user's desktop appears.

Where to run your script

Everything prior to XSession runs as root. /etc/gdm/Xsession and everything after runs as the user. This leaves you with three real options for where to run your script.

  1. Modify GDM/KDM's PostLogin or PreSession scripts to run your program. The username is available in the USER or USERNAME environment variables.

  2. Use PAM to execute your script. PAM will set the authorizing user in the PAM_USER environment variable. Add this to /etc/pam.d/gdm to kick off your script:

    auth  required  pam_exec.so   /path/to/your/script
    
    • You might be able to use PAM to match a particular user (as in this answer), so the script would only run for that user and wouldn't need to match users itself. I don't have the PAM expertise to explain how to do that.

  3. Write an Upstart script to run your program. Your script would start at user login, so we look for the desktop-session-start signal emitted by GDM's PreSession script.

    So an Upstart script would detect that signal as the run trigger:

    # start when GDM's PreSession script runs
    start on desktop-session-start
    

    The signal from PreSession doesn't pass along the username, so you'd need to tweak the signal. In /etc/gdm/PreSession/Default, find the initctl line and change it to this. You could also use USERNAME in place of USER.

    # add USER variable so Upstart script can find it
    initctl -q emit desktop-session-start DISPLAY_MANAGER=gdm USER=$USER
    

    See the manpages for Upstart and its starting event for more details.


How to avoid the Admin user

Your script will need to examine the user/username in the environment variables it gets from one of these methods and use that to determine whether to abort or continue. Standard shell-scripting methods will work. Depending on which starting location you chose from the above list, the username may be available in the USER, USERNAME, or PAM_USER environment variables.

share|improve this answer
add comment

You could use setuid, to always run the program as root. From a security point of view, this is probably a very, very bad idea. If one of your users managed to exploit the setuid program it will give them root access to the whole server

share|improve this answer
    
that works if it's a program the user wants to run. i don't think that's what this questioner is looking for tho. –  quack quixote Apr 25 '10 at 5:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.