running a binary as root

[robc]

I just built bleachbit (http://bleachbit.sourceforge.net/) into an extension, but in order for it to run properly (ie use swapoff, remove some files) it will need to be ran as root. Setting the permissions to 4755 does not seem to help. The only ways that seem to work are using sudo and as the root user.

I would like to make it easy for the end user so they will only need to select it from the menu or click on it in wbar. Is it appropriate to use the sudo command in cases like this? Some users may have there sudo locked down so it would not work properly on their system. Or should I just run the binary as the normal user and leave it up to the user to explicitly call the binary as root if/when needed?

[roberts]

Is it beacuse it is linked in from loop? Perhaps a startup script to force copy into filesystem with desired permissions?

[robc]

well, the binary is actually a python script. I have manually changed the permissions to 4755 after I loaded the extension, this does not work. I think it is a problem because it is a python script.

[gerald_clark]

Scripts cannot run setuid, only binaries.
This is a security issue.

[robc]

Scripts cannot run setuid, only binaries.
This is a security issue.

Yes I just read this, I would have to create a C wrapper for this to work.

[roberts]

Just curious, how does that project suggest it be run?

[robc]

Just curious, how does that project suggest it be run?

They use the sudo command to run the application as root from a menu...here is a bug report about it: https://bugs.launchpad.net/bleachbit/+bug/480488

[gerald_clark]

What advantage would a C wrapper have over sudo?
Sudo is a C wrapper with configurable security features.

[robc]

What advantage would a C wrapper have over sudo?
Sudo is a C wrapper with configurable security features.

I was thinking the same thing. I'll just use sudo and comment in the info file that sudo needs to be properly configured for running scripts.
Or would it be better to offer both a non-root and root option in the menu? what about for wbar then?