'becomes' script (was Re: last call ... newgrp...)

Just for sport, decided to sketch a 'becomes --user=... --group=...'
script, to see what horrors unfold.

I decided it's no security risk at all, because you've got
to be root already before it does anything interesting :-)

Is this line worth pursuing?  (run 'ssh remote becomes
--user=... --group=...' and blast the desired script at it?)

Will

==== becomes script =====
#!/usr/bin/env python

import grp,os,pwd,string,sys

intended_user = None
intended_grp  = None

for arg in sys.argv[1:]:
    if arg[0:7] == '--user=':
	intended_user = arg[7:]
    elif arg[0:8] == '--group=':
	intended_grp = arg[8:]
    else:
	sys.stderr.write('duff arg:%s\n'%arg)
	sys.exit(1)

if intended_user == None:
    sys.stderr.write('--user=... not set\n')
    sys.exit(1)
if intended_grp == None:
    sys.stderr.write('--group=... not set\n')
    sys.exit(1)

if len(intended_user) <= 0:
    sys.stderr.write('--user=%s is duff\n'%intended_user)
    sys.exit(1)
if len(intended_grp) <= 0:
    sys.stderr.write('--group=%s is duff\n'%intended_group)
    sys.exit(1)

try:
    intended_uid = pwd.getpwnam(intended_user)[2]
except KeyError:
    sys.stderr.write('--user=%s is duff\n'%intended_user)
    sys.exit(1)

try:
    intended_gid = grp.getgrnam(intended_grp)[2]
except KeyError:
    sys.stderr.write('--group=%s is duff\n'%intended_grp)
    sys.exit(1)

# Is this user in that group? (chk both pwd and grp dbs)
# root is excluded from this test
grp1_gid  = pwd.getpwnam(intended_user)[3] # primary grp, from pwd
grpN_mems = grp.getgrnam(intended_grp)[3] # other grps, by name
if intended_uid == 0 or intended_gid == grp1_gid or intended_user in grpN_mems:
   pass
else:
    sys.stderr.write('--=%s is not in --group=%s\n'%(intended_user,intended_grp))
    sys.exit(1)

curr_euid = os.geteuid()
curr_egid = os.getegid()

if intended_gid != curr_egid:
    # 2.2 -> os.setgroups to the user's legit list;
    # otherwise, we are probably operating with root's
    os.setgid(intended_gid)

if intended_uid != curr_euid:
    os.setuid(intended_uid)

sh = os.popen('/bin/sh','w',0) # 0 -> unbuffered
#sh.write('/usr/bin/id\n')
while 1:
    l = sys.stdin.readline()
    if not l: break
    sh.write(l)

status = sh.close()
if status != None:
    sys.stderr.write('/bin/pipe close failed!\n')
    sys.exit(1)

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas - http://devcon.sprintpcs.com/adp/index.cfm?source=osdntextlink