473,728 Members | 1,843 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Python prog needs root -how to do this securely

I have a Python program which runs as user 'www' (it's a CGI).
It needs root privilege to write a particular file.
What's the best way of doing this while remaining secure?

Right now I do os.system("sudo myutil parms") and pass the parms to it.
I remove : < > & | from the parm string before passing it.
Is there a way to do this without making a system call?
i.e.
gimme_root()
my code...
drop_root()


Jul 18 '05 #1
1 1387
John D. <li***@webcrunc hers.com> wrote:
I have a Python program which runs as user 'www' (it's a CGI).
It needs root privilege to write a particular file.
What's the best way of doing this while remaining secure?

Right now I do os.system("sudo myutil parms") and pass the parms to it.
I remove : < > & | from the parm string before passing it.
Is there a way to do this without making a system call?


With your approach you have to be aware that users on the system will probably
be able to view the parameters your are passing to myutil. Whether this is a
problem depends on your particular setup.

One alternative would be to make nobody, apache, etc. (which ever your apache
server runs under) the group owners of the file and give the apache group
write permissions to the file. This may not be feasible for your setup.

--
----------------------------------------------------------------------------
Suchandra Thapa
s-********@NOSPAM alumni.uchicago .edu
----------------------------------------------------------------------------
Jul 18 '05 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

0
4935
by: Ben Eisenberg | last post by:
I'm trying to run a php script setuid. I've tried POSIX_setuid but you have to be root to run this. The files are located on a public access unix system and have me as the owner and nobody as the group. Rather than make them group writable where in anybody could make a script and write to my files i would like to make them setuid. I tried making a c prog with the setuid function. I used chmod and made it setuid. I called it with the system...
4
6524
by: Edward K. Ream | last post by:
Previous to Python 2.3 my app has destroyed the root Tk window using root.destroy rather than the more usual root.quit. In Python 2.3 this does not work so well. In some situations (i.e., for some data), Tk (not Tkinter) complains that an "after" routine does not exist that has been registered with the Tkinter after routine. Moreover, in Python 2.3, the tkinter after_cancel routine does not appear to work at all, regardless of whether...
2
1616
by: Rien Kok | last post by:
Hi, I have a strange problem. I want to install Plone (Plone2-2.0.0rh-2.i386.rpm) Because Plone 2.0 needs Python 2.3.3, I installed Python 2.3.3 from source (Python-2.3.3.tar). Everything went well. After installing Python I did a reboot of the server and checked if Python works. Quote:
2
1357
by: abhinav | last post by:
//A CRAWLER IMPLEMENTATION please run this prog. on the shell and under the control of debugger when this prog. is run normally the prog. does not terminate .It doesn't come out of the cond. if c<5: so this prog. continues infinitely but if this prog is run under the control of debugger the prog terminates when the cond. if c<5: becomes false i think this prob. may be due to multithreading pls help.
24
2839
by: Mark | last post by:
Hi, I'm new to python and looking for a better idiom to use for the manner I have been organising my python scripts. I've googled all over the place about this but found absolutely nothing. I'm a linux/unix command line guy quite experienced in shell scripts etc. I have a heap of command line utility scripts which I run directly. What is the best way to create python command line scripts but exploit the (loadonly) speed-up benefit of...
9
2668
by: Katie Tam | last post by:
I am new to this filed and begin to learn this langague. Can you tell me the good books to start with ? Katie Tam Network administrator http://www.linkwaves.com/main.asp http://www.linkwaves.com
3
3948
by: Jeffrey Froman | last post by:
Hello All, I have two python versions installed, one in /usr/bin, and one in /usr/local/bin. However, when invoking python without a full path, I get the wrong executable with the right sys.executable string! ---------------------------------------------------------------------------- # ls -l /usr/local/bin/python* -rwxr-xr-x 2 root root 3783810 Jul 19 09:15 /usr/local/bin/python -rwxr-xr-x 2 root root 3783810 Jul 19 09:15...
0
1482
by: Tomas | last post by:
Dear group. I have some big problems getting python to work with svn. Python SVN and SWIG is compiled from source. I have been testing Python 2.5.1 and 2.4.4 together with SWIG 1.3.25 and 1.3.33 and SVN 1.4.5 and 1.4.6 All combinations creates the same problem: # python Python 2.4.4 (#1, Feb 25 2008, 08:46:36)
2
2036
by: Jean-Paul Calderone | last post by:
On Mon, 16 Jun 2008 08:39:52 +1000, Ben Finney <bignose+hates-spam@benfinney.id.auwrote: Maybe. I'm no expert on Debian packaging. However, exarkun@boson:~$ ls -l /usr/lib/python2.{4,5}/site-packages/sqlite/main.py lrwxrwxrwx 1 root root 63 2007-12-27 15:29 /usr/lib/python2.4/site-packages/sqlite/main.py -/usr/share/pycentral/python-sqlite/site-packages/sqlite/main.py lrwxrwxrwx 1 root root 63 2007-12-27 15:29...
5
1435
by: aha | last post by:
Hello All, I have a situation where I can count on a Python installation being available on a system, but I can't count on it being a version of Python needed by my application. Since my application has it's own version of Python installed with it how should I use the system Python to launch the version of Python that launches my Application. Yes, this is a convoluted process, but not all Pythons are built the same :) Right now I am...
0
9421
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
9276
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
0
8126
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
1
6716
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...
0
6013
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
4524
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
4790
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
2
2659
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
3
2161
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.