Index: pykota/trunk/bin/cupspykota
===================================================================
--- pykota/trunk/bin/cupspykota (revision 1974)
+++ pykota/trunk/bin/cupspykota (revision 2006)
@@ -24,4 +24,7 @@
 #
 # $Log$
+# Revision 1.82  2005/01/06 22:52:53  jalet
+# Implemented the dropping of priviledges. Beware, beware...
+#
 # Revision 1.81  2004/12/07 16:54:02  jalet
 # Now logs as errors differences between computed and precomputed job's sizes
@@ -613,4 +616,7 @@
             # Here we absolutely WANT to remove any filename from the command line !
             arguments = [ "Fake this because we are printing a banner" ] + sys.argv[1:6]
+            
+        self.regainPriv()    
+        
         self.logdebug("Starting real backend %s with args %s" % (realbackend, " ".join(['"%s"' % a for a in ([os.environ["DEVICE_URI"]] + arguments[1:])])))
         subprocess = PyKotaPopen4([realbackend] + arguments[1:], bufsize=0, arg0=os.environ["DEVICE_URI"])
@@ -818,4 +824,7 @@
         else :    
             retcode = self.removeJob()
+            
+        self.dropPriv()    
+        
         return retcode    
     
Index: pykota/trunk/NEWS
===================================================================
--- pykota/trunk/NEWS (revision 2002)
+++ pykota/trunk/NEWS (revision 2006)
@@ -24,4 +24,7 @@
     - 1.21alpha17 :
      
+        - Now drops priviledges to user 'pykota' when launched as root
+          (directly or as a CUPS backend), if such an user exists.
+          
         - Fixed PCL3/4/5 parser for some drivers' output.
         
Index: pykota/trunk/pykota/tool.py
===================================================================
--- pykota/trunk/pykota/tool.py (revision 1977)
+++ pykota/trunk/pykota/tool.py (revision 2006)
@@ -22,4 +22,7 @@
 #
 # $Log$
+# Revision 1.147  2005/01/06 22:52:53  jalet
+# Implemented the dropping of priviledges. Beware, beware...
+#
 # Revision 1.146  2004/12/09 23:03:57  jalet
 # Fixed a bug when pkbanner's output was piped into another command (e.g. gs)
@@ -575,4 +578,7 @@
     def __init__(self, lang="", charset=None, doc="PyKota %s (c) 2003-2004 %s" % (version.__version__, version.__author__)) :
         """Initializes the command line tool."""
+        # did we drop priviledges ?
+        self.privdropped = 0
+        
         # locale stuff
         defaultToCLocale = 0
@@ -611,10 +617,11 @@
         # try to find the configuration files in user's 'pykota' home directory.
         try :
-            pykotauser = pwd.getpwnam("pykota")
+            self.pykotauser = pwd.getpwnam("pykota")
         except KeyError :    
+            self.pykotauser = None
             confdir = "/etc/pykota"
             missingUser = 1
         else :    
-            confdir = pykotauser[5]
+            confdir = self.pykotauser[5]
             missingUser = 0
             
@@ -635,4 +642,7 @@
             raise
             
+        # now drop priviledge if possible
+        self.dropPriv()    
+        
         # We NEED this here, even when not in an accounting filter/backend    
         self.softwareJobSize = 0
@@ -647,4 +657,39 @@
         arguments = " ".join(['"%s"' % arg for arg in sys.argv])
         self.logdebug("Command line arguments : %s" % arguments)
+        
+    def dropPriv(self) :    
+        """Drops priviledges."""
+        uid = os.geteuid()
+        if uid :
+            try :
+                username = pwd.getpwuid(uid)[0]
+            except (KeyError, IndexError), msg :    
+                self.printInfo(_("Strange problem with uid(%s) : %s") % (uid, msg), "warn")
+            else :
+                self.logdebug(_("Running as user '%s'.") % username)
+        else :
+            if self.pykotauser is None :
+                self.logdebug(_("No user named 'pykota'. Not dropping priviledges."))
+            else :    
+                try :
+                    os.setegid(self.pykotauser[3])
+                    os.seteuid(self.pykotauser[2])
+                except OSError, msg :    
+                    self.printInfo(_("Impossible to drop priviledges : %s") % msg, "warn")
+                else :    
+                    self.logdebug(_("Priviledges dropped. Now running as user 'pykota'."))
+                    self.privdropped = 1
+            
+    def regainPriv(self) :    
+        """Drops priviledges."""
+        if self.privdropped :
+            try :
+                os.seteuid(0)
+                os.setegid(0)
+            except OSError, msg :    
+                self.printInfo(_("Impossible to regain priviledges : %s") % msg, "warn")
+            else :    
+                self.logdebug(_("Regained priviledges."))
+                self.privdropped = 0
         
     def getCharset(self) :    
