允许用户www-data（apache）调用需要来自CGI脚本的root特权的python脚本

Question

The python script script.py is located in /usr/bin/monitor/scripts and it's main function is to use subprocess.check_call() and subprocess.check_output() to call various administrative tools (both c programs located in /usr/bin/monitor/ created specifically for the machine, and linux executables in /sbin like fdisk -l and df -h ). It was written to run as root and print output from these programs in a useful way to the command line.

My project is to make the output from this script viewable through a webpage. I'm on a Beaglebone Black using Apache2, which executes files as user www-data from its DocumentRoot, /var/www/html/ . The webpage is set up like this:

1. index.html uses an iframe to display the output of a python CGI script which is also located in /var/www/html/

2. script.cgi attempts to call/display output from script.py output using the subprocess module

The problem is that script.py is being called just fine, but each of the calls within script.py fail and return script.py's error messages because I presume they need to be run as root when apache is running them as user www-data .

To try to get around this, I created a new group called bbb , added www-data to the group, then ran chown :bbb script.py to change its group to bbb. Unfortunately it was still causing the same problems, so I tried changing permissions from 755 to 775, which didn't work either. I tried running chown :bbb * on the files/programs that script.py uses, also to no avail. Also, some of the executables script.py uses are in /sbin and I am cautious to just give it blanket root access to directories like this.

Since my attempts at fixing ownership issues felt a bit like 1000 monkey code, I created new version of the script in which I create a list of html output, and after each print statement in the original code, I append the same line of text as a string with html tags to the html output list, then at the end of the script (in whatami) I have it create and write to a .txt file in /var/www/html/ , and call os.chmod("/var/www/html/data.txt", 0o755) to give apache access. The CGI then calls subprocess.check_call() on script.py, then opens, reads, and prints each line with html formatting to the iframe in the webpage. This attempt at least resulted in accurate output but... it only updates when it is run in terminal as root, rather than re-running script.py ever time the page is refreshed, which kind of undermines the point of the webpage. I assume this means the subprocess check_call in the CGI script is not working correctly, but for some reason, the subprocess call itself doesn't throw any errors or indications of failure, yet the text file returns without being updated. Even with the subprocess call in a “try” block succeeded by a “print('call successful')”, it returns the success message and then the not updated text file.

I'm a bit at a loss trying to figure out how to just force the script to run and do it's thing in the background so that the file will update without just giving apache root access. I've read a few things about either wrapping the python script in a shell that causes it to be run as root, or to change sudoers to give www-data sudo priviledges, but I do not want to introduce security issues or make what was intended to be a simple script allowing output to a webpage to become more convoluted than it already has. Any advice or direction would be greatly appreciated.

Answer 1

Best way IMO would be to "decouple" execution, by creating a localhost-only service which you "call" from the apache process by connecting via a local socket.

Eg if using systemd :

Create: /etc/systemd/system/my-svc.socket

[Unit]
Description=My svc socket

[Socket]
ListenStream=127.0.0.1:1234
Accept=yes

[Install]
WantedBy=sockets.target

Create: /etc/systemd/system/my-svc@.service

[Unit]
Description=My Service
Requires=my-svc.socket

[Service]
Type=simple
ExecStart=/opt/my-service/script.sh %i
StandardInput=socket
StandardError=journal
TimeoutStopSec=5

[Install]
WantedBy=multi-user.target

Create /opt/my-service/script.sh:

#!/bin/sh
echo "id=$(id)"
echo "args=$*"

Finish setup with:

$ sudo chmod +x /opt/my-service/script.sh
$ sudo systemctl daemon-reload

Try it out:

$ nc 127.0.0.1 1234
id=uid=0(root) gid=0(root) groups=0(root)
args=55-127.0.0.1:1234-127.0.0.1:32938

Then from your cgi , you'll need to do the equivalent of the nc command above (just a tcp connection).

--jjo