PHP posix_setuid函数代码示例

 public static function setuidgid($user)
 {
     $uid = posix_getuid();
     if ($uid !== 0) {
         throw new \RuntimeException("setuidgid is only root");
     }
     $nam = posix_getpwnam($user);
     if (!$nam) {
         throw new \RuntimeException("unkonwn user \"{$user}\"");
     }
     $uid = $nam['uid'];
     $gid = $nam['gid'];
     if (!posix_setgid($gid)) {
         throw new \RuntimeException("unable setgid({$gid})");
     }
     if (!posix_setegid($gid)) {
         throw new \RuntimeException("unable setegid({$gid})");
     }
     if (!posix_setuid($uid)) {
         throw new \RuntimeException("unable setuid({$uid})");
     }
     if (!posix_seteuid($uid)) {
         throw new \RuntimeException("unable seteuid({$uid})");
     }
 }

 /**
  * 此事件在worker进程启动时发生。这里创建的对象可以在worker进程生命周期内使用。
  * 
  * @param ISwoole $sw
  * @param int $worker_id
  */
 function onWorkerStart($sw, $worker_id)
 {
     $this->ctx->pid = getmypid();
     $user = posix_getpwnam($this->ctx->cfgs['default']['owner']['user']);
     posix_setuid($user['uid']);
     posix_setgid($user['gid']);
     $this->worker_id = $worker_id;
 }

 /**
  * 设置进程运行账号
  * @param [type] $user [description]
  */
 public static function setUser($user)
 {
     $userInfo = posix_getpwnam($user);
     if (!$userInfo) {
         return;
     }
     posix_setgid($userInfo['gid']);
     posix_setuid($userInfo['uid']);
 }

 public static function setUid($uid, $gid)
 {
     if (!posix_setgid($gid)) {
         // 必须先设置GID, 再设置UID
         throw new Exception("Unable to set GID: " . posix_strerror(posix_get_last_error()));
     }
     if (!posix_setuid($uid)) {
         throw new Exception("Unable to set UID: " . posix_strerror(posix_get_last_error()));
     }
 }

/**
 * Change the identity to a non-priv user
 */
function change_identity($uid, $gid)
{
    if (!posix_setgid($gid)) {
        print "Unable to setgid to " . $gid . "!\n";
        exit;
    }
    if (!posix_setuid($uid)) {
        print "Unable to setuid to " . $uid . "!\n";
        exit;
    }
}

 /**
  * 改变进程的用户ID
  * @param $user
  */
 static function changeUser($user)
 {
     if (!function_exists('posix_getpwnam')) {
         trigger_error(__METHOD__ . ": require posix extension.");
         return;
     }
     $user = posix_getpwnam($user);
     if ($user) {
         posix_setuid($user['uid']);
         posix_setgid($user['gid']);
     }
 }

 function onStart($serv)
 {
     if (!defined('WEBROOT')) {
         define('WEBROOT', $this->config['server']['webroot']);
     }
     if (isset($this->config['server']['user'])) {
         $user = posix_getpwnam($this->config['server']['user']);
         if ($user) {
             posix_setuid($user['uid']);
             posix_setgid($user['gid']);
         }
     }
     $this->log(self::SOFTWARE . ". running. on {$this->server->host}:{$this->server->port}");
 }

 /**
  * 构造方法
  */
 public function __construct($setting)
 {
     $this->config = $setting['config'];
     $this->cronPath = $setting['cron_path'];
     if (isset($setting['group'])) {
         $groupinfo = posix_getpwnam($setting['group']);
         posix_setgid($groupinfo['gid']);
     }
     if (isset($setting['user'])) {
         $userinfo = posix_getgrnam($setting['user']);
         posix_setuid($groupinfo['uid']);
     }
     include __DIR__ . '/ParseCrontab.php';
     include __DIR__ . '/ParseInterval.php';
 }

 protected function dropPrivileges(array $server)
 {
     if (!array_key_exists('user', $server) and !array_key_exists('group', $server)) {
         // nothing to do
         return;
     }
     if (posix_getuid() != 0) {
         echo "\n[Warning] Can't change uid/gid because aip is not run by superuser\n";
         return;
     }
     if (isset($server['user'])) {
         posix_setuid(self::getUserId($server['user']));
     }
     if (isset($server['group'])) {
         posix_setgid(self::getGroupId($server['group']));
     }
 }

 function run($work)
 {
     if (1 === posix_getppid()) {
         return;
     }
     if ($this->user) {
         if (!posix_setgid($this->user['gid']) || !posix_setuid($this->user['uid'])) {
             throw new \RuntimeException("Unable to switch to user '{$this->user['name']}'");
         }
     }
     Utility::fork(function () use($work) {
         if (-1 === posix_setsid()) {
             throw new \RuntimeException('Unable to set setsid()');
         }
         if (false === chdir('/')) {
             throw new \RuntimeException('Unable to chdir(\'/\')');
         }
         umask(0);
         Utility::fork($work);
     });
 }

 /**
  * @return bool
  */
 private function changeUser()
 {
     $user = $this->container->getConfig()->get('command.user');
     // Bypass cache commands as we need the sudoer user to run the commands
     if (null !== $user && (!isset($_SERVER['argv'][1]) || $_SERVER['argv'][1] !== 'flushall') && (!isset($_SERVER['argv'][1]) || $_SERVER['argv'][1] !== 'redis:flushall') && (!isset($_SERVER['argv'][1]) || $_SERVER['argv'][1] !== 'apc:flushall')) {
         $name = $user;
         $user = posix_getpwnam($user);
         posix_setgid($user['gid']);
         posix_setuid($user['uid']);
         if (posix_geteuid() !== (int) $user['uid']) {
             $output = new ConsoleOutput();
             $formatter = new FormatterHelper();
             $output->writeln('', true);
             $errorMessages = array('', ' [Error] ', ' Could not change user to ' . $name . ' ', '');
             $formattedBlock = $formatter->formatBlock($errorMessages, 'error');
             $output->writeln($formattedBlock);
             $output->writeln('', true);
             return false;
         }
     }
     return true;
 }

/**
 * Function to prepare a node before starging it
 *
 * @param   Node    $n                  The Node
 * @param   Int     $id                 Node ID
 * @param   Int     $t                  Tenant ID
 * @param   Array   $nets               Array of networks
 * @return  int                         0 Means ok
 */
function prepareNode($n, $id, $t, $nets)
{
    $user = 'unl' . $t;
    // Get UID from username
    $cmd = 'id -u ' . $user . ' 2>&1';
    exec($cmd, $o, $rc);
    $uid = $o[0];
    // Creating TAP interfaces
    foreach ($n->getEthernets() as $interface_id => $interface) {
        $tap_name = 'vunl' . $t . '_' . $id . '_' . $interface_id;
        if (isset($nets[$interface->getNetworkId()]) && $nets[$interface->getNetworkId()]->isCloud()) {
            // Network is a Cloud
            $net_name = $nets[$interface->getNetworkId()]->getNType();
        } else {
            $net_name = 'vnet' . $t . '_' . $interface->getNetworkId();
        }
        // Remove interface
        $rc = delTap($tap_name);
        if ($rc !== 0) {
            // Failed to delete TAP interface
            return $rc;
        }
        // Add interface
        $rc = addTap($tap_name, $user);
        if ($rc !== 0) {
            // Failed to add TAP interface
            return $rc;
        }
        if ($interface->getNetworkId() !== 0) {
            // Connect interface to network
            $rc = connectInterface($net_name, $tap_name);
            if ($rc !== 0) {
                // Failed to connect interface to network
                return $rc;
            }
        }
    }
    // Preparing image
    // Dropping privileges
    posix_setsid();
    posix_setgid(32768);
    if ($n->getNType() == 'iol' && !posix_setuid($uid)) {
        error_log('ERROR: ' . $GLOBALS['messages'][80036]);
        return 80036;
    }
    if (!is_file($n->getRunningPath() . '/.prepared') && !is_file($n->getRunningPath() . '/.lock')) {
        // Node is not prepared/locked
        if (!is_dir($n->getRunningPath()) && !mkdir($n->getRunningPath(), 0775, True)) {
            // Cannot create running directory
            error_log('ERROR: ' . $GLOBALS['messages'][80037]);
            return 80037;
        }
        if ($n->getConfig() == 'Saved' && $n->getConfigData() != '') {
            // Node should use saved startup-config
            if (!dumpConfig($n->getConfigData(), $n->getRunningPath() . '/startup-config')) {
                // Cannot dump config to startup-config file
                error_log('WARNING: ' . $GLOBALS['messages'][80067]);
            }
        }
        switch ($n->getNType()) {
            default:
                // Invalid node_type
                error_log('ERROR: ' . $GLOBALS['messages'][80038]);
                return 80038;
            case 'iol':
                // Check license
                if (!is_file('/opt/unetlab/addons/iol/bin/iourc')) {
                    // IOL license not found
                    error_log('ERROR: ' . $GLOBALS['messages'][80039]);
                    return 80039;
                }
                if (!file_exists($n->getRunningPath() . '/iourc') && !symlink('/opt/unetlab/addons/iol/bin/iourc', $n->getRunningPath() . '/iourc')) {
                    // Cannot link IOL license
                    error_log('ERROR: ' . $GLOBALS['messages'][80040]);
                    return 80040;
                }
                break;
            case 'docker':
                if (!is_file('/usr/bin/docker')) {
                    // docker.io is not installed
                    error_log('ERROR: ' . $GLOBALS['messages'][80082]);
                    return 80082;
                }
                $cmd = 'docker inspect --format="{{ .State.Running }}" ' . $n->getUuid();
                exec($cmd, $o, $rc);
                if ($rc != 0) {
                    // Must create docker.io container
                    $cmd = 'docker create -ti --net=none --name=' . $n->getUuid() . ' -h ' . $n->getName() . ' ' . $n->getImage();
                    exec($cmd, $o, $rc);
                    if ($rc != 0) {
                        // Failed to create container
//.........这里部分代码省略.........

 /**
  * Causes this pseudo-thread to begin parallel execution.
  *
  * This method first checks of all the Shared Memory Segment. If okay, it
  * forks the child process, attaches signal handler and returns immediatly.
  * The status is set to running, and a PID is assigned. The result is that
  * two pseudo-threads are running concurrently: the current thread (which
  * returns from the call to the start() method) and the other thread (which
  * executes its run() method).
  * 
  * @throws ZendX_Console_Process_Exception When SHM segments can't be created
  * @throws ZendX_Console_Process_Exception When process forking fails
  * @return void
  */
 public function start()
 {
     if (!$this->_ipcIsOkay) {
         require_once 'ZendX/Console/Process/Exception.php';
         throw new ZendX_Console_Process_Exception('Unable to create SHM segments for process communications');
     }
     // @see http://www.php.net/manual/en/function.pcntl-fork.php#41150
     @ob_end_flush();
     pcntl_signal(SIGCHLD, SIG_IGN);
     $pid = @pcntl_fork();
     if ($pid === -1) {
         require_once 'ZendX/Console/Process/Exception.php';
         throw new ZendX_Console_Process_Exception('Forking process failed');
     } else {
         if ($pid === 0) {
             // This is the child
             $this->_isChild = true;
             // Sleep a second to avoid problems
             sleep(1);
             // Install the signal handler
             pcntl_signal(SIGUSR1, array($this, '_sigHandler'));
             // If requested, change process identity
             if ($this->_guid !== null) {
                 posix_setgid($this->_guid);
             }
             if ($this->_puid !== null) {
                 posix_setuid($this->_puid);
             }
             // Run the child
             try {
                 $this->_run();
             } catch (Exception $e) {
                 // We have to catch any exceptions and clean up the process,
                 // else we will have a memory leak.
             }
             // Destroy the child after _run() execution. Required to avoid
             // unuseful child processes after execution
             exit(0);
         } else {
             // Else this is the parent
             $this->_isChild = false;
             $this->_isRunning = true;
             $this->_pid = $pid;
         }
     }
 }

 /**
  * Check and chdir to $_workDir
  *
  * @return   void
  */
 private function ___init_userGroup()
 {
     $this->_debug("-----> " . __CLASS__ . '::' . __FUNCTION__ . '()', 9);
     // Get current uid and gid
     $uid_cur = posix_getuid();
     $gid_cur = posix_getgid();
     // If not root, skip the rest of this procedure
     if ($uid_cur != 0) {
         $this->_log("Skipping the setUid/setGid part, because we are not root");
         return;
     }
     // Get desired uid/gid
     $r = posix_getpwnam($this->_user);
     if ($r === false) {
         throw new A2o_AppSrv_Exception("Unable to get uid for user: {$this->_user}");
     }
     $userData = $r;
     $r = posix_getgrnam($this->_group);
     if ($r === false) {
         throw new A2o_AppSrv_Exception("Unable to get gid for group: {$this->_group}");
     }
     $groupData = $r;
     $uid_desired = $userData['uid'];
     $gid_desired = $groupData['gid'];
     // Change effective uid/gid if required
     if ($gid_cur != $gid_desired) {
         $r = posix_setgid($gid_desired);
         if ($r === false) {
             throw new A2o_AppSrv_Exception("Unable to setgid: {$gid_cur} -> {$gid_desired}");
         }
         $this->_debug("Group (GID) changed to {$this->_group} ({$gid_desired})");
     }
     if ($uid_cur != $uid_desired) {
         $r = posix_setuid($uid_desired);
         if ($r === false) {
             throw new A2o_AppSrv_Exception("Unable to setuid: {$uid_cur} -> {$uid_desired}");
         }
         $this->_debug("User (UID) changed to {$this->_user} ({$uid_desired})");
     }
     $this->_debug("Setuid/setgid complete");
 }

 /**
  * 尝试设置运行当前进程的用户
  * @return void
  */
 protected static function setProcessUser($user_name)
 {
     if (empty($user_name) || posix_getuid() !== 0) {
         return;
     }
     $user_info = posix_getpwnam($user_name);
     if ($user_info['uid'] != posix_getuid() || $user_info['gid'] != posix_getgid()) {
         if (!posix_setgid($user_info['gid']) || !posix_setuid($user_info['uid'])) {
             self::log('Notice : Can not run woker as ' . $user_name . " , You shuld be root\n", true);
         }
     }
 }