Correctly managing permissions (Python)

yms · 2010-12-16 18:18:09

Hi,

I am currently writing a script that is writing, sorting and merging thousands of files in a huge tree in my file-system. Several users on the machine have to use the program (let's call it P) and it is out of question to run it as root.

I have a Unix group also called P that has the whole tree I was referring to previously. This is it for now.

How to create a user (called P) just for my program (like for example apache does) ? Does it have to be a "system user" (created with -r) ?
How to tell my Python script to write files with a given ownership (namely P:P) and permissions ?

Thank you in advance,

yms

boogy · 2010-12-16 19:40:32

Well if the script is executed with a users account the files and folders that it creates will be owned by that user. You can scepifically change permissions with your script or use the setgid bit on the folders... And you can create a normal user with no login bash and execute the script with the name of that user.

you can put the setuid of that user on your script so it will always hav the rights of that specific user. You can also use the sudo power to manage permissions for that script for other users on your machine ... Hope this helps.

tavianator · 2010-12-16 23:21:39

boogy wrote:

you can put the setuid of that user on your script so it will always hav the rights of that specific user.

For security reasons, Linux doesn't honour the setuid/setgid bits on scripts; only executables. In order to run as a specific user the script must start with root privileges and setuid() itself, or be run by something like cron which can run tasks as specific users.

yms · 2010-12-17 10:38:02

Thank you for your answers. It is quite helpful but what I really need is to know how to do these things. What options I should pay attention to when using useradd (or adduser) and how to manage the permissions and ownership (especially group ownership) in the actual Python code (http://docs.python.org/library/os.html does not tell me much about that).

delerious010 · 2010-12-20 04:38:29

Hi yms,

There are a number of possibilities depending on how exactly you need this to be done / what your requirements are.

If the script is initially called as root, then within the python script you could always use os.seteuid, os.setegid ( ex.: http://snipplr.com/view/5503/drop-privileges/ ). This would effectively mean that, though the script was called by root, it would interact with files as the user you specified. This is similar to what apache would do I believe.

Alternately, you could simply have the script executed via sudo or su so that the script itself is called by user P.

Or, if you require each inidividual user to call the script themselves, with their own credentials, you could simply setup ACLs on the folder so that users never lose access to another user's files.

Arch Linux

#1 2010-12-16 18:18:09

Correctly managing permissions (Python)

#2 2010-12-16 19:40:32

Re: Correctly managing permissions (Python)

#3 2010-12-16 23:21:39

Re: Correctly managing permissions (Python)

#4 2010-12-17 10:38:02

Re: Correctly managing permissions (Python)

#5 2010-12-20 04:38:29

Re: Correctly managing permissions (Python)

Board footer