Question

I need to manage Linux users accounts from within my program so I actually need some kind of root access but giving root to that program couldn’t be the best solution.
How can I manage that in a save way. At least I am not aware of a Multi process architecture.
For the whole “generic stuff” I use Qt. Only the OS-specific things are on my own.

Answer 1

The “classic” solution to implement privilege separation works like this:

• install the program with setuid-0
• early in the program startup (do this as early as possible, preferably “the first thing your program does”):
  • create a pair of sockets using socketpair()
  • fork() your process
  • have your main process drop all its root UIDs using setuid() and continue as usual
• your child process will execute a loop to process commands sent from the main process

The result will be that your main process has no special privileges, but you have a root-privileged child process that is connected to your main process via those sockets. These sockets are “unnamed”, meaning no other program can access them.

You are still somewhat vulnerable to attacks, of course. Even if your code is “safe” until you get to the fork(), an attacker could still be able to get into your main program later on, and send commands to the privileged process. Even if the child process is good at validating its input and can’t be compromised, valid commands can still cause problems when issued by an attacker — like in your case, an attacker could probably create new accounts, possibly even one that has uid 0.