> I want to execute an application from java ,but this
> application will start only if you are root , so
> first I want to log as root and second to start that
> application
What is this application?
There is probably some very good reason for you to have to be root to execute it...
> I want to execute start/restart/stop Snort from a
> Java application ,so that I want to execute first as
> root
You could do some magic with Runtime.exec, after detecting platform and environment (I don't know if possible for Win/Mac, but I wouldn't think you're running snort under those platforms anyway)...
Process p = null;
String[] cmd;
if ( isKDE() ) { // detect process kdeinit
cmd = new String[] {"gksu", "/etc/init.d/snort", "start"};
} else if ( isGnome() ) { // detect gnome-settings-daemon/something similar
cmd = new String[] {"kdesu", "/etc/init.d/snort", "start"};
} else {
cmd = null;
}
if (null == cmd) {
// Alert about an unsupported platform.
} else {
Runtime.getRuntime().exec(p);
}
Note: this code is untested and may not work. It's just an idea.
The following works for me on RHEL4/64bit, running under Eclipse3.2.2 using Sun JDK 1.5:package javaforum;
import java.io.BufferedReader;
import java.io.BufferedWriter;
import java.io.InputStreamReader;
import java.io.OutputStreamWriter;
public class SudoTest {
public static void main(String[] args) throws Exception {
String[] cmd = new String[] { "sudo", "/sbin/service", "httpd", "start" };
System.out.print("Gimme root pwd plizkthxbai: ");
String rootPwd = new BufferedReader(new InputStreamReader(System.in)).readLine();
Process p = Runtime.getRuntime().exec(cmd);
BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(p.getOutputStream()));
bw.write(rootPwd, 0, rootPwd.length());
bw.newLine();
bw.flush();
}
}
Don't log in as root, it's bad - that's what sudo is for.
Grant
If you're going to use Grant's program then I suggest changing the prompt slightly, because sudo asks for the user's password rather than root's.
However, it strikes me that a better solution would be to make your snort executable suid, change its group ownership to a new group (e.g. "snort") with execution rights, then add people who need to run it to that group.
addgroup snort
chown root:snort `which snort`
chmod 4750 `which snort`
> If you're going to use Grant's program then I suggest
> changing the prompt slightly, because sudo asks for
> the user's password rather than root's.
Oh...darn. Sorry, yes, true enough.
> However, it strikes me that a better solution would
> be to make your snort executable suid, change its
> group ownership to a new group (e.g. "snort") with
> execution rights, then add people who need to run it
> to that group.
Mmmm, sure, that would work. Guess I was stuck on "don't log in as root!", more than on elegant solutions to the actual problem :).
G
> However, it strikes me that a better solution would
> be to make your snort executable suid, change its
> group ownership to a new group (e.g. "snort") with
> execution rights, then add people who need to run it
> to that group.
> addgroup snort
> chown root:snort `which snort`
> chmod 4750 `which snort`
Minor nit: this is actually setgid, meaning that anyone who runs that file automatically gets to be part of the snort group. Thus, by doing that, you don't have to add people to the snort group. You can do what you're talking about (adding people to the snort group) and not have to setgid the script.
Just so the OP knows (and as prob.not.sol said above), this is potentially insecure, and could open up your system to security holes. You could be opened up to local (maybe even remote) privilege escalation threats.