Setuid in Java

Question

Hi,
We have a Java application on Unix (Linux/Solaris/HP-UX). It can be run by
any user (non-root). The application needs to write into a file, which is
owned by root. How does one achieve this?
In "C/C++", we can use the "setuid" command, to get "root" privileges for
doing this. (e.g. the Unix "passwd" command is a setuid program)
We tried to achieve the same in Java, by having a "native" method, which
does a setuid and tries to write to the file. However, it is unable to
"setuid" to root.
Has any one faced a similar scenario? If so, how was it handled?
Is there an alternate approach for this problem?
One discovery regarding "setuid" from Java (through JNI) is that, we can run
the application as "root", and downgrade permission to a non-root user.
However, our requirement is for the reverse, viz., run as non-root, and
upgrade as required.
We also cannot have an entry in "java.policy" file granting permission to
write to a file, which the OS does not permit. (e.g. we cannot grant "write"
permission to /etc/passwd, because the OS permissions do not allow non-root
users to write to the file).
Thanks in advance for any pointers on this.
Tiju

Answer 1

On many unix platforms, the "java" command is a shell script that calculates a bunch of paths and then runs the "real" java runtime.
Also on many unix platforms, suid behavior is disabled for shell scripts because it is a security hole that can allow unauthorized users to get root permissions.
The work around is to write a small C program that checks all of its parameters, and then does an exec(2) call to start the java runtime for your program. You would then make this C program suid root. The effect is that your java program would then be suid root.