Limiting "sudo kill" to killing only user processes

[TheJuiceman]

Hey gang,

Has anyone come up with a way to allow a user to sudo kill but restricting it so it cannot kill system processes, etc? Basically I want the user to be able to kill only user processes.

Thanks

[Patrick Wallek]

You would have to write a wrapper script for kill. The script would take the pid that you provide and make sure that it is allowed to be killed.

[TheJuiceman]

Agreed. How would be the best way to write a script like that? Thanks

[TheJuiceman]

And it doesn't have to be "kill" per se. I could have them run a different script called, say, "killuser" to perform the task. I'm just not sure how to put in all the "safety guards" to make sure the script works without accidents or loopholes. Thanks.

[Steven E. Protter]

Shalom,

The OS is set up to only let users kill processes they would have permissions to. Their own, stuff launched by their own group.

Give sudo kill they can of course do anything.

To have a granular kill, you need a script to take care of the decision to kill or not to kill.

Someone may want to write that script for you, but its a project and if I can't write the script in a few minutes, or have it in inventory, I usually refer you to a consultant (sometimes me).

I would in such a script check the process table and kill based on characteristics I find there.

I mean if you only want to kill user scripts a simple way is to check for root and other system users, those are system, and any other user have at it.

Give your users this power and they will crash something important. I can almost give you a warranty on that.

SEP

[Dennis Handly]

>I want the user to be able to kill only user processes.

What's your definition of a user process? Anyone that isn't root, lp or sfmdb?
Or a UID < 1000?

#!/usr/bin/sh
# Kill a list of PIDs and skip ones for users
# with UID < 1000

for pid in $*; do
uid=$(UNIX95=EXTENDED_PS ps -p $pid -ouid=)
if [ $uid < 1000 ]; then
echo "skip system process" 2>&1
continue
fi
kill $pid
done

[TheJuiceman]

Thanks Dennis. That is closer to what I am looking for. Just need to put in "safe guards" to eliminate possible mistakes or work-arounds. Any suggestions?

[James R. Ferguson]

Hi:

> Just need to put in "safe guards" to eliminate possible mistakes or work-arounds.

By setting UNIX95 (XPG4) behavior you have the ability to create custom 'ps' queries as the manpages document. As Dennis suggested, you could limit candidates to those whose UID is in an acceptable range. You might want to evaluate based on elapsed runtime and or combinations of parameters (e.g. uid, etime and command name).

WIth the 'UNIX95' behavior, selection by command name can be made "exactly" with the '-C' option:

# UNIX95= ps -C sh -opid -ouid= -oetime=

...which would return a list of 'sh' processes where the list consists of the 'pid', 'uid' and elapsed time without a heading (which is what the "=" suppresses. You could then further parse this output to collect a subset of pids to kill.

Regards!

...JRF...

[TheJuiceman]

Thank you for the responses.  Would there be an easy way to limit the processes being killed to those being started by someone/something in a particular group (ie. only processes started by someone in group "users")?  This would be a better (and safer) solution for me than limiting UID's to under 1000, etc.  Thanks!!!!

[TheJuiceman]

errr.....I mean UID > 1000.....you know what I mean ha