8

I am writing a simple script which restarts a hadoop slave. In the script, I have to do some initial changes as a root user. After that I have to change to user "hadoop" and perform set of commands. I was using os.system to run commands but I doubt whether it works well. For example: 

uid=pwd.getpwnam('hadoop')[2]
os.setuid(uid)
os.system('whoami')
os.chdir('/home/hadoop/hadoop/')
os.system('bin/hadoop-daemon.sh stop tasktracker')

Again I have to perform some commands as root after this and again become user "hadoop" and execute : 

os.system('bin/hadoop-daemon.sh stop tasktracker')

I have three questions here ,

  1. Is os.system is the best command that I can use to issue linux commands ?

  2. I am able to change from root user to user hadoop by the commands above but I am not able to change to root user (I can understand there will be security issues if they permit this, I want to know is there any possibility to do that , atleast by passing password) ?

  3. Does os.setuid() work ? whoami prints user hadoop but the process "tasktracker" is not stopped using those command, but if i perform the same commands manually it works fine (I use "su hadoop" instead of setuid while trying it out manually).

Thanks for all your help.

  • Sethu
sethu
  • 1,691
  • 4
  • 22
  • 34

4 Answers4

7

you could use:

os.system('sudo -u hadoop bin/hadoop-daemon.sh stop tasktracker')

or if you dont have sudo, but have su

os.system('su hadoop -c "bin/hadoop-daemon.sh stop tasktracker"')
Mike
  • 1,784
  • 1
  • 12
  • 12
  • Mike, I have to run these command as a hadoop user, but there are other commands i have to run as a root user. But in practice , while using sudo , we are prompted to enter our password right ? – sethu Nov 06 '11 at 13:57
  • If the root user runs the python script all the commands should be executed as root, "sudo -u hadoop ...." runs a command as if you were the specified user, and because you run that command as root there should be no password promt. – Mike Nov 06 '11 at 20:10
  • For how to do this using **subprocess**, see https://stackoverflow.com/questions/1770209/run-child-processes-as-different-user-from-a-long-running-process/6037494#6037494 – storm_m2138 Oct 02 '17 at 22:10
3

It is a much better idea to use "su" than to switch the user ID using os.setuid().

Why?

  • "su" will set up the login credentials correctly, including the group ID, and supplemental groups
  • "su" will also do other useful things, such as setting environment variables (particularly if you use su - ). Maybe it will also set ulimit limits according to limits.conf.
MarkR
  • 62,604
  • 14
  • 116
  • 151
1

This kind of scripts can be implemented much cleaner with use of fabric library: http://docs.fabfile.org/en/1.3.1/index.html Additionally it provides nice command-line interface and capabilities of remote servers management via ssh. All the python is available so you can connect to databases for example or import whatever you need.

Exactly the question about running commands as some other user can be implemented with sudo command with user arg: http://docs.fabfile.org/en/1.3.1/api/core/operations.html#fabric.operations.sudo

Ivan Blinkov
  • 2,466
  • 15
  • 17
0

I haven't done this myself but I see several os functions that may apply. They start here: http://docs.python.org/library/os.html#os.setegid

Also, there was a thread on the tutor list that addressed the topic: http://mail.python.org/pipermail/tutor/2002-December/018981.html

The os.system approach is limited because it only returns an error code. The subprocess.Popen toolset is more flexible.

Raymond Hettinger
  • 216,523
  • 63
  • 388
  • 485