canSU checks whether the current process can run su with the right username. If su can be run, this returns the path to the su command. If not, this returns the empty string "".
()
| 431 | // If su can be run, this returns the path to the su command. |
| 432 | // If not, this returns the empty string "". |
| 433 | func (s *userServer) canSU() string { |
| 434 | su, err := exec.LookPath("su") |
| 435 | if err != nil { |
| 436 | s.logf("can't find su command: %v", err) |
| 437 | return "" |
| 438 | } |
| 439 | |
| 440 | // First try to execute su <user> -c true to make sure we can su. |
| 441 | err = exec.Command( |
| 442 | su, |
| 443 | s.username, |
| 444 | "-c", "true", |
| 445 | ).Run() |
| 446 | if err != nil { |
| 447 | s.logf("su check failed: %s", err) |
| 448 | return "" |
| 449 | } |
| 450 | |
| 451 | return su |
| 452 | } |
| 453 | |
| 454 | // assertNotRoot returns an error if the current user has UID 0 or if we cannot |
| 455 | // determine the current user. |