Re: [Zope] Unix: Vanishing Group Ids associated with Zope process ?
At 17:48 2002-10-11 +0200, Holger Blasum said:
Hello *,
I observed that under Debian woody, Zope 2.5.1 runs under the user id 'www-data'.
The python OS command os.getgroups() gives me an empty list when called from an external method, although I had configured the user 'www-data' to be the member of several groups.
If, on the other hand, I run python with my user id from the command line as a normal user, the command os.getgroups () gives me all the groups am a member of (that's what I expected).
Please enlighten.
The way that Zope changes user under the start up sequence doesn't change the groups. I'm not sure if this was due to a bug in earlier Python, but there might be a fix/more info about this in the mail archives or on zope.org or even in the collector (haven't check). Got the same problems a while back trying to execute Qmail commands with external methods some while ago. Regards, Johan Carlsson -- Torped Strategi och Kommunikation AB Johan Carlsson johanc@easypublisher.com Mail: Birkagatan 9 SE-113 36 Stockholm Sweden Visit: Västmannagatan 67, Stockholm, Sweden Phone +46-(0)8-32 31 23 Fax +46-(0)8-32 31 83 Mobil +46-(0)70-558 25 24 http://www.easypublisher.com http://www.torped.se
On Fri, Oct 11, 2002 at 06:05:59PM +0200, Johan Carlsson [EasyPublisher] wrote:
The way that Zope changes user under the start up sequence doesn't change the groups.
man 2 setgroups should be called after (before?) the user id change in the Zope startup script. it is called for you by PAM when you log in, AFAIK, this is why it works from your command line hth Jerome Alet
Thanks Jerome, Johan,
it is called for you by PAM when you log in, AFAIK, this is why it works from your command line
That was the missing bit. After following some blind alleys (pam-python seems to be only available for py 1.5 and os.setgroups() is only available in py 2.2) the solution was to run in /etc/init.d/zope 'su www-data -c 'zope-z2 ARGS'' instead of just 'zope-z2 ARGS' so that PAM is called by su. I didn't even have to adjust the zope-z2 script because the os.setuid() is not called when it is not run as root. Data.fs.lock and some other stuff in /var/lib/zope/var is now owned by www-data instead of root, so it is not necessarily best practice but works. Have a nice weekend, -- Holger Blasum
participants (3)
-
Holger Blasum -
Jerome Alet -
Johan Carlsson [EasyPublisher]