问题描述
我正在Linux上使用C编写应用程序.在我的应用程序中，我需要在开始时以普通用户(非root用户)执行一些任务，而在执行过程中也需要以root用户执行一些任务.
I'm writing an application using C on Linux. In my application, I need to do some tasks at the beginning with normal user (Non root user) while I need to do some tasks with root user in the middle of execution as well.
顺便说一句，我不能修改普通用户的配置.因此，我无法将普通用户添加到sudoers.我也无法修改任何操作系统配置.
By the way, I cannot modify configurations of normal user. So I cannot add normal user to sudoers. I cannot modify any OS configurations as well.
我的应用程序真正要做的是执行应用程序，获取其输出以进行分析.
What my application really do is execute applications, get their outputs for analysing.
某些应用程序需要使用root运行.我使用多线程并行执行和分析这些应用程序的输出，然后将每个应用程序的报告存储在称为报告"的单例中.我在子流程中使用execvp调用这些应用程序.
Some applications need to be run with root. I use multi-threads to execute and analyse outputs of these applications in parallel then stores report of each application in a singleton called Report. I call these applications using execvp in sub-process.
我的应用程序的主要目的是自动化软件测试.并且大多数任务需要在不能为root的软件所有者中运行.
The main purpose of my application is to automate software testing. And most task is required to run in software owner which shall not be root.
所以，问题出在
- 如何在执行过程中切换用户?
- 无论如何，我可以在1个可执行文件中实现它吗?
- 使用POSIX API进行此操作更好.
- 以普通用户身份运行我的应用程序，为我的应用程序提供root密码，使用root密码切换到root.
推荐答案
详细了解 setuid 可执行文件和 setreuid(2)和 execve(2)系统调用.请注意，您需要使用chmod u+s将setuid标志放在可执行文件上(请参见 chmod(1)) > chown(1))并仔细编码，以避免安全漏洞.
Read more about setuid executables and setreuid(2) and execve(2) syscalls. Be careful, you'll need to put the setuid flag on the executable with chmod u+s (see chmod(1)) after changing its ownership (with chown(1)) and code carefully to avoid security holes.
Setuid是获取(或撤消)特权的基本机制(由，sudo，super，login等使用).参见 credentials(7)& capabilities(7).
Setuid is the basic mechanism (used by su, sudo, super, login etc...) programs to get (or revoke) privileges. See credentials(7) & capabilities(7).
启动一些帮助程序(以root身份或在/usr/libexec/中启动一些setuid可执行文件...)并使用一些进程间通信设施(例如管道(7) ...).例如，不建议在根进程中使用GTK或Qt之类的GUI工具包.如果您的应用程序具有一些GUI，则可以在非root用户(普通用户)进程中运行其GUI，并以root用户身份运行(希望很小的)帮助程序进程来进行root用户，以完成需要特殊特权的实际工作.
It could be safer to start some helper process (as root, or start some setuid executable perhaps in /usr/libexec/ ...) and communicate with it using some inter-process communication facilities (like pipe(7)...). For example, it is not recommended to use GUI toolkits like GTK or Qt in root processes. If your app has some GUI, it is reasonable to run its GUI in a non-root (ordinary user) process and run as root the (hopefully small) helper process doing the real job requiring special privileges.
在编码之前，我建议阅读一本好书，例如 高级Linux编程 和 syscalls(2)以及每个系统调用. 安全性方面尤其重要.
Before coding, I recommend reading a good book like Advanced Linux Programming and syscalls(2) and the documentation of every system call you would use. Security aspects are especially important.
Setuid可执行文件不一定需要或使用任何密码.反过来说:需要密码的程序(特别是login，su，sudo等.)是setuid(它们是免费软件(在Linux上，因此您可以研究其源代码)；尝试ls -l /bin/su /usr/bin/sudo /bin/login进行检查.
Setuid executables don't necessarily require or use any password; it is the other way round: programs requiring passwords (notably login, su, sudo etc....) are setuid (and they are free software on Linux so you can study their source code); try ls -l /bin/su /usr/bin/sudo /bin/login to check that.
由于您要模拟各种用户环境，因此请注意 environ( 7).
Since you want to emulate various user environments, be aware of environ(7).
这篇关于如何在Linux上使用C执行期间切换用户的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！