Changing the owner of an existing process in Linux

Question

I would like to start tomcat (Web Server) as a privileged user, and then bring it back to an unprivileged user once it has started. Is there a way to do this programatically, or in general with Linux?

Thanks.

Answer 1

The underlying system call that you need is setuid(2), but it's not exposed by any of the Java APIs.

It's not hard to write a JNI wrapper that would give access to it though, although even then you'd need to find a suitable place in the Tomcat startup code to invoke setuid after the bind(2) calls have been made (those being the ones that normally require the root privileges).

As recommended by geocar you could use authbind so that Tomcat never needs to run as root at all.

Alternatively, as you've presumably got root access on the server in question, just run Tomcat on a non-privileged port and then use iptables tricks to forward inbound requests from the privileged port to the one that Tomcat is actually listening on. See this SO post for info on how to do this.