Re: Setting user IDs and Groups

["David Morris" <David.Morris@xxxxxxxxxxxxx>]

Ed,

Sorry about the confusion in my message; it also looks like
something in my mail client ate the body to my last reply.
The seteuid() API does work with proper authority. It is
odd to me that it set the group to *NONE if it is not running
with *ALLOBJ. I just thought that was strange and that I
should get back an error. I can see now that it does not
ever touch the supplemental groups.

Since this idea does not do everything I want, back to the
original plan, which was to avoid the chgusrprf command.
I can't seem to find an API that will change the supplemental
groups for a usrprf.

David Morris


>>> edfishel@us.ibm.com 01/31/02 01:34PM >>>

David,

>My initial tests with
>these Unix APIs were promising. In a few places they
>refer to groups (plural) and I was hoping that the set
>effective group ID profile accepted an array and I was
>just dense.

I think the plural "groups" the documentation is talking about are the
real, effective, and saved groups.

>...it looks like the set effective group GID should do what
>I want, but just one at a time. I can retrieve the GID,
>which appears to correspond to the GID I set on the
>profile.  When I pass it to the setegid API, it ends up
>setting my group to *NONE.

This does not sound right. If you change the effective group profile of
the
thread to the GID of a group profile, then you should not see *NONE as
the
group for that thread.

>                        I am just calling qsysetegid()
>with a 4-byte integer that contains the GID I get back
>from getgrname().
>
>Any ideas on whether this will work?

This part sounds like it should work. These set group APIs allow you to
set
the group profile without changing the current user profile or any of
the
15 supplemental groups. If you need to change any of the supplemental
groups then the only way to do that is with the Set Profile Handle
(QWTSETP, QsySetProfileHandle) API.

Ed Fishel,
edfishel@US.IBM.COM