> you want to drop privileges (as in Docker entry-points) but you don't want your process to be child process of su or sudo process.
> Unlike su or sudo this tool would exec to replace the current process (so it would receive signals ..etc.)
Where did you get the idea that su or sudo spawn a child processes for
commands to run? I would be very, very wary of any security-sensitive code
from author who didn't get such a basic thing right.
Unless you do very magic thing and replace my current shell, which would be
the parent process of your command.
Oh damn, my bad. I completely forgot that sudo can update wtmp and generally other things when closing PAM session, and thus it does spawn child processes. I totally deserve any flak here.
4 comments
[ 2.8 ms ] story [ 16.7 ms ] thread> Unlike su or sudo this tool would exec to replace the current process (so it would receive signals ..etc.)
Where did you get the idea that su or sudo spawn a child processes for commands to run? I would be very, very wary of any security-sensitive code from author who didn't get such a basic thing right.
Unless you do very magic thing and replace my current shell, which would be the parent process of your command.
so if you type "su -l -c sleep app" and type "ps ax" you would see a the "su" process and a child process.
if you do that with "oneway", there wont be a process called oneway.
the usage of this is you can have "exec oneway" in your start.sh and you would end up with no privileged processes at all.
on the other hand this won't happen even if you "exec su -c bash exec " no matter how many exec you type. there will always be a su/sudo process
http://imgur.com/a/IzrXR