<p>I want a user-privileged (not root) process to launch new processes as user <code>nobody</code>. I've tried a straight call to <code>setuid</code> that fails with -1 <code>EPERM</code> on <code>Ubuntu 8.04</code>:</p>

<pre><code>#include &lt;sys/types.h&gt;
#include &lt;unistd.h&gt;

int main() { 
       setuid(65534);
       while (1);
       return 0;
}
</code></pre>

<p>How should I do this instead?</p>

[{'answer_id': 66887, 'author': 'zigdon', 'author_id': 4913, 'author_profile': 'https://Stackoverflow.com/users/4913', 'pm_score': 1, 'selected': False, 'text': "<p>As far as I know, you can't unless you're root or have sudo set up to allow you to switch users.  Or, you can have your executable have the suid bit set up on it, and have it owned by nobody.  But that requires root access too.</p>\n"}, {'answer_id': 66937, 'author': 'squadette', 'author_id': 7754, 'author_profile': 'https://Stackoverflow.com/users/7754', 'pm_score': 5, 'selected': True, 'text': '<p>You <em>will</em> require assistance and a lot of trust from your system administrator.  Ordinary users are not able to run the executable of their choice on behalf on other users, period.</p>\n\n<p>She may add your application to <code>/etc/sudoers</code> with proper settings and you\'ll be able to run it as with <code>sudo -u nobody</code>.   This will work for both scripts and binary executables.</p>\n\n<p>Another option is that she will do <code>chown nobody</code> and <code>chmod +s</code> on your binary executable and you\'ll be able to execute it directly.  This task must be repeated each time your executable changes.    </p>\n\n<p>This could also work for scripts if you\'ll create a tiny helper executable which simply does <code>exec("/home/you/bin/your-application")</code>.   This executable can be made suid-nobody (see above) and you may freely modify <code>your-application</code>.</p>\n'}, {'answer_id': 67046, 'author': 'Allan Wind', 'author_id': 9706, 'author_profile': 'https://Stackoverflow.com/users/9706', 'pm_score': 0, 'selected': False, 'text': '<p><a href="http://www.keltia.net/programs/calife/" rel="nofollow noreferrer"><code>calife</code></a> is an alternative to <code>sudo</code>.</p>\n\n<blockquote>\n  <p>Calife is small program that enable a UNIX system administrator to become root (or another user) on his/her machines without giving the root password but his/her own.</p>\n</blockquote>\n'}, {'answer_id': 67088, 'author': 'Hugh Buchanan', 'author_id': 9307, 'author_profile': 'https://Stackoverflow.com/users/9307', 'pm_score': 0, 'selected': False, 'text': "<p>The 'nobody' user is still a user.  I'm not sure what your reasoning is in having the program run as nobody, it's not going to be adding any additional security.  You're more likely to open yourself to other problems.</p>\n\n<p>I'd follow squadette's recommendation of using a helper application.</p>\n"}, {'answer_id': 14887127, 'author': 'jldugger', 'author_id': 9947, 'author_profile': 'https://Stackoverflow.com/users/9947', 'pm_score': 0, 'selected': False, 'text': '<p>I ran across the <a href="http://code.google.com/p/setuid-sandbox/" rel="nofollow">setuid-sandbox</a> project today while reading LWN, which does what I\'m looking for the proper way. </p>\n'}]
['https://Stackoverflow.com/questions/66870', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/9947/']