Python wrapper for setfsuid

setfsuid.py

# based on https://gist.github.com/atdt/ebafa299e843a767139b

# Copyright (c) 2019 Ori Livneh
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS AND CONTRIBUTORS ``AS IS''
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED.IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

import ctypes
import ctypes.util
import errno
import os


class Setfs:

    def __init__(self):
        libc_so = ctypes.util.find_library('c')
        self.libc = ctypes.CDLL(libc_so, use_errno=True)

    def setgid(self,fsgid):
        """Set user identity used for filesystem checks. See setfsgid(2)."""
        # Per the BUGS section in setfsgid(2), you can't really tell if a
        # setfsgid call succeeded. As a hack, we can rely on the fact that
        # setfsgid returns the previous fsgid and call it twice. The result
            # of the second call should be the desired fsgid.
        self.libc.setfsgid(ctypes.c_int(fsgid))
        new_fsgid = self.libc.setfsgid(ctypes.c_int(fsgid))

        # Fake an EPERM even if errno was not set when we can detect that
        # setfsgid failed.
        err = errno.EPERM if new_fsgid != fsgid else ctypes.get_errno()
        if err:
            raise OSError(err, os.strerror(err))

    def setuid(self,fsuid):
        """Set user identity used for filesystem checks. See setfsuid(2)."""
        # Per the BUGS section in setfsuid(2), you can't really tell if a
        # setfsuid call succeeded. As a hack, we can rely on the fact that
        # setfsuid returns the previous fsuid and call it twice. The result
        # of the second call should be the desired fsuid.
        self.libc.setfsuid(ctypes.c_int(fsuid))
        new_fsuid = self.libc.setfsuid(ctypes.c_int(fsuid))

        # Fake an EPERM even if errno was not set when we can detect that
        # setfsuid failed.
        err = errno.EPERM if new_fsuid != fsuid else ctypes.get_errno()
        if err:
            raise OSError(err, os.strerror(err))

Transformed into class, added setgid