Re: last call for setting group with newgrp...

Jonathan wrote:

> Hmmm. Sorry, do you mean that you'll re-invoke ARK on the remote side, a la
> the current mechanism for remote Python code? So it'll do:
> 
>     ssh remote /our/bin/ark thing --this-and-no-more method what
> 
> and then ARK will change group and invoke a local shell to do the
> appropriate work?

Yes, I suppose so.  I'm not too happy about that because
it means the ArkHost.run() method is really really
ARK-method-specific.

An alternative, I suppose, is to write a Very Small python
thing, say 'become', that you run as

    ssh remote sudo become --user=<blah> --group=<blargh>

where 'become' does the setgid, then the setuid, and then
execs a /bin/sh over itself.  However, I do *not* like
writing code with serious security implications :-)

Will

PS: Interesting snippet from the sudo TODO file:

   TODO list (most will be addressed in sudo 2.0)
   ...

   12) Add -g group/gid option.