从 Python 运行的 bash 脚本达到 sudo 超时

Question

This is a long bash script (400+ lines ) that is originally invoked from a django app like so -

os.system('./bash_script.sh &> bash_log.log')

It stops on a random command in the script. If the order of commands is changed, it hangs on another command in approx. the same location.

ssh ing to the machine that runs the django app, and running sudo./bash_script.sh , asks for a password and then runs all the way.

I can't see the message it presents when it hangs in the log file, couldn't make it redirect there. I assume it's a sudo password request.

Tried -

• sudo -v in the script - didn't help.
• ssh to the machine and manually extend the sudo timeout in /etc/sudoers - didnt help, I think since the django app is already in the air and uses the previos timeout.
• splitting the script in two, and running one in separate thread, like so -

def basher(command, log_path):
    with open(log_path) as log:
        Popen(command, stdout=log, stderr=log).wait()

script_thread = Thread(target=basher, args=('bash_script_pt1.sh', 'bash_log_pt1.log'))
script_thread.start()
os.system('./bash_script_pt2.sh &> bash_log_pt2.log') # I know it's deprecated, not sure if maybe it's better in this case
script_thread.join()

The logs showed that part 1 ended ok, but part 2 still hangs, albeit later in the code than when they were together.

I thought to edit /etc/sudoers from inside the Python code, and then re-login via su - user . There are snippets of how to pass the password using pty , however I don't understand the mechanics of it and could not get it to work.

I also noted that ps aux | grep bash_script.sh ps aux | grep bash_script.sh shows that the script is being run twice. As -

/bin/bash bash_script.sh

and as

sh -c bash_script.sh .

I assume os.system has an internal shell=True going on.

I don't understand the Linux entities/mechanics in play to figure out what's happening.

Answer 1

My guess is that the django app has different and more limited permissions, than the script itself does, and the script is inheriting said restrictions because it is being executed by it.

You need to find out what permissions the script has when you run it just from bash, and what it has when you run it via django, and then figure out what the difference is.