6

I have been playing around with subprocess lately. As I do more and more; I find myself needing root access. I was wondering if there is an easy way to enter the root password for a command that needs it with subprocess module. So when I am prompted for the password my script and provide it and run the command. I know this is bad practice by where the code will be running is sandboxed and separate from the rest of the system; I also dont want to be running as root.

I would really appreciate small example if possible. I know you can do this with expect, but i am looking something more python centric. I know pexpect exsists but its a bit overkill for this simple task.

Thanks.

Jubbles
  • 4,450
  • 8
  • 35
  • 47
Mahdi Yusuf
  • 19,931
  • 26
  • 72
  • 101
  • I don't really understand the sentence "So when I am prompted for the password my script and provide it and run the command." Do you want the user to enter the root password, or do you want to hardcode the root password in your code? (I hope it's not the latter!) – Sven Marnach Jun 03 '11 at 15:47
  • @Sven I would like to do both; I know the latter is bad. I am just wondering if it is possible. – Mahdi Yusuf Jun 03 '11 at 15:49
  • We would appreciate a small example of what you've tried, if possible. – AJ. Jun 03 '11 at 15:50
  • See this question it's very similar http://stackoverflow.com/questions/4748971/django-and-root-processes/4749073#4749073 – Joe Jun 03 '11 at 15:51
  • For the second option you will end up with the same problem as the problem discussed here: http://stackoverflow.com/questions/4144134/python-execute-scp-stdin-for-password-not-working – mouad Jun 03 '11 at 15:52

1 Answers1

10

It would probably be best to leverage sudo for the user running the Python program. You can specify specific commands and arguments that can be run from sudo without requiring a password. Here is an example:

There are many approaches but I prefer the one that assigns command sets to groups. So let's say we want to create a group to allow people to run tcpdump as root. So let's call that group tcpdumpers.

First you would create a group called tcpdumpers. Then modify /etc/sudoers (using the visudo command):

# Command alias for tcpdump
Cmnd_Alias      TCPDUMP = /usr/sbin/tcpdump

# This is the group that is allowed to run tcpdump as root with no password prompt
%tcpdumpers     ALL=(ALL) NOPASSWD: TCPDUMP

Now any user added to the tcpdumpers group will be able to run tcpdump like this:

% sudo tcpdump

From there you could easily run this command as a subprocess.

This eliminates the need to hard-code the root password into your program code, and it enables granular control over who can run what with root privileges on your system.

Kusalananda
  • 14,885
  • 3
  • 41
  • 52
jathanism
  • 33,067
  • 9
  • 68
  • 86
  • I recently had to do something similar for a splunk alert script. sudo is really made for this. – Ori Jun 03 '11 at 16:01
  • 2
    Note that editing the sudoers file should really be done with `visudo`, rather than any other arbitrary editor - otherwise it can lead to things like http://unix.stackexchange.com/questions/138237/i-changed-etc-sudoers-and-now-i-cant-run-as-sudo – godlygeek Jun 20 '14 at 11:46