Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to call an executable from a PHP script that needs to be run as a different user (NOT root) than the web server normally runs as. I thought it should be sufficient to just set the setuid bit on the executable in question, as it is already owned by the user it needs to run as. However, when I do this I get this error:

The application with bundle ID (null) is running setugid(), which is not allowed

Apparently at some point Mac OS X broke the ability to run setuid programs unless you are running as root. I definitely do not want the web server to run as root or the other user!

It appears that Apple has some special hoops you have to jump through to authorize such a thing to occur - problem is, if I am understanding it correctly, this method prompts the user to enter a password or something. This obviously is not acceptable from a script run from a web server! Another potential problem is that I can't modify the executable to introduce some kind of authentication call.

share|improve this question
    
Why does it need to be run as another user? –  terdon Mar 21 '13 at 17:24
    
The executable needs to connect to the Window server in order to access a device (the iSight); otherwise it doesn't find any devices. Apparently the latest versions of OS X don't let you even access the device unless somebody is logged in. That somebody is the user that the script needs to be run as. –  Michael Mar 21 '13 at 17:26
    
More specifically, the error I get if the executable is run by nobody is "_RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL." after which it fails to find the device. –  Michael Mar 21 '13 at 17:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.