Python Popen：通过sudo将环境变量传递给以其他用户身份运行的命令

Question

The subprocess.Popen() function has a "env" parameter. But it doesn't seem to have the desired effect with sudo. This is what I get when I do this in the interactive Python shell:

import subprocess
env={"CVS_RSH":"ssh"}
command = "sudo -u user cvs -d user@1.8.7.2:/usr/local/ncvs co file.py"
p = subprocess.Popen(command, stdout=subprocess.PIPE,
    stderr=subprocess.PIPE,env=env,shell=True)
(command_output, error_output) = p.communicate()
p.wait()

1
>>> error_output
b'cvs [checkout aborted]: cannot exec rsh: No such file or 
directory\ncvs [checkout aborted]: end of file from server (consult 
above messages if any)\n'

The message is distracting, so let me explain. I'm forced to use ancient CVS and the environment variable tells it to use ssh to connect to the server, rather than the default which sadly is rsh. It also needs an environment variable called CVS_ROOT, but fortunately there's a "-d" option for that, but none for the CVS_RSH that I know of.

Interestingly enough, if I do:

command = "sudo -u user echo $CVS_RSH"
env={"CVS_RSH":"something_else"}
p = subprocess.Popen(command, stdout=subprocess.PIPE, 
    stderr=subprocess.PIPE,env=env,shell=True)
(command_output, error_output) = p.communicate()
p.wait()

0
>>> command_output
b'something_else\n'

Maybe this worked because echo wasn't actually started as a child process? Is it possible to pass an environment to a process executed as another user with sudo?

Answer 1

This doesn't seem possible using the env parameter. The solution seems to be to just pass the environment as I was doing on the shell, for example:

command = "sudo -u user CVS_RSH=ssh 
    CVSROOT=:ext:user@2.8.7.2:/usr/local/ncvs cvs co dir/file.py"
p = subprocess.Popen(command, stdout=subprocess.PIPE, 
    stderr=subprocess.PIPE,env=env,shell=True)

The weird thing is, if I do this in a Python CGI script, I can see:

cvs [checkout aborted]: cannot exec ssh: Permission denied

cvs [checkout aborted]: end of file from server (consult above messages if any)

But if I try on the interactive Python shell, it goes past this, so it must be another weird (because the user has permission to ssh) issue, unrelated to this question.