How to run specific program with root privileges (Ubuntu OS) when no sudo user log into system?

Question

How do I run a specific program with root privileges (Ubuntu OS) when no sudo user is logged into the system? The program needs root privileges to function correctly. A normal user shouldn't be able to shutdown this process. For example, I have two users, Admin and Client; The program should start only when the client logs into the system. It needs root privileges and the Client shouldn't be able to shut this process down.

Solution 1

There are a few ways to do this. Ubuntu's graphical login is provided by GDM (or KDM if you're using Kubuntu). GDM is started by the Upstart subsystem.

The startup process follows these steps:

1. System boots. Upstart starts services, including GDM (/etc/init/gdm).
2. GDM starts, initializes the X-server (/etc/gdm/Init/*), and presents the GUI login window.
3. A user logs in.
   1. PAM authorization happens (/etc/pam.d/gdm)
   2. GDM runs PostLogin script (/etc/gdm/PostLogin/*).
   3. GDM runs PreSession script (/etc/gdm/PreSession/*).
   4. GDM runs Xsession and xinit scripts
      (/etc/gdm/Xsession, /etc/X11/xinit/xinitrc.d/*, /etc/X11/Xsession, /etc/X11/Xsession.d/*)
4. The user's desktop appears.

---

Where to run your script

Everything prior to XSession runs as root. /etc/gdm/Xsession and everything after runs as the user. This leaves you with three real options for where to run your script.

1. Modify GDM/KDM's PostLogin or PreSession scripts to run your program. The username is available in the USER or USERNAME environment variables.

2. Use PAM to execute your script. PAM will set the authorizing user in the PAM_USER environment variable. Add this to /etc/pam.d/gdm to kick off your script:

   auth  required  pam_exec.so   /path/to/your/script
   

   • You might be able to use PAM to match a particular user (as in this answer), so the script would only run for that user and wouldn't need to match users itself. I don't have the PAM expertise to explain how to do that.
     
     

3. Write an Upstart script to run your program. Your script would start at user login, so we look for the desktop-session-start signal emitted by GDM's PreSession script.

   So an Upstart script would detect that signal as the run trigger:

   # start when GDM's PreSession script runs
   start on desktop-session-start
   

   The signal from PreSession doesn't pass along the username, so you'd need to tweak the signal. In /etc/gdm/PreSession/Default, find the initctl line and change it to this. You could also use USERNAME in place of USER.

   # add USER variable so Upstart script can find it
   initctl -q emit desktop-session-start DISPLAY_MANAGER=gdm USER=$USER
   

   See the manpages for Upstart and its starting event for more details.

---

How to avoid the Admin user

Your script will need to examine the user/username in the environment variables it gets from one of these methods and use that to determine whether to abort or continue. Standard shell-scripting methods will work. Depending on which starting location you chose from the above list, the username may be available in the USER, USERNAME, or PAM_USER environment variables.

Solution 2

You could use setuid, to always run the program as root. From a security point of view, this is probably a very, very bad idea. If one of your users managed to exploit the setuid program it will give them root access to the whole server