Running commands from within python that need root access

Question

I have been playing around with subprocess lately. As I do more and more; I find myself needing root access. I was wondering if there is an easy way to enter the root password for a command that needs it with subprocess module. So when I am prompted for the password my script and provide it and run the command. I know this is bad practice by where the code will be running is sandboxed and separate from the rest of the system; I also dont want to be running as root.

I would really appreciate small example if possible. I know you can do this with expect, but i am looking something more python centric. I know pexpect exsists but its a bit overkill for this simple task.

Thanks.

I don't really understand the sentence "So when I am prompted for the password my script and provide it and run the command." Do you want the user to enter the root password, or do you want to hardcode the root password in your code? (I hope it's not the latter!) — Sven Marnach
– Sven Marnach, Commented Jun 3, 2011 at 15:47
@Sven I would like to do both; I know the latter is bad. I am just wondering if it is possible. — Mahdi Yusuf
– Mahdi Yusuf, Commented Jun 3, 2011 at 15:49
We would appreciate a small example of what you've tried, if possible. — AJ.
– AJ., Commented Jun 3, 2011 at 15:50
See this question it's very similar stackoverflow.com/questions/4748971/django-and-root-processes/… — Joe
– Joe, Commented Jun 3, 2011 at 15:51
For the second option you will end up with the same problem as the problem discussed here: stackoverflow.com/questions/4144134/… — mouad
– mouad, Commented Jun 3, 2011 at 15:52

Kusalananda · Accepted Answer · 2019-11-16 12:08:34Z

10

It would probably be best to leverage sudo for the user running the Python program. You can specify specific commands and arguments that can be run from sudo without requiring a password. Here is an example:

There are many approaches but I prefer the one that assigns command sets to groups. So let's say we want to create a group to allow people to run tcpdump as root. So let's call that group tcpdumpers.

First you would create a group called tcpdumpers. Then modify /etc/sudoers (using the visudo command):

# Command alias for tcpdump
Cmnd_Alias      TCPDUMP = /usr/sbin/tcpdump

# This is the group that is allowed to run tcpdump as root with no password prompt
%tcpdumpers     ALL=(ALL) NOPASSWD: TCPDUMP

Now any user added to the tcpdumpers group will be able to run tcpdump like this:

% sudo tcpdump

From there you could easily run this command as a subprocess.

This eliminates the need to hard-code the root password into your program code, and it enables granular control over who can run what with root privileges on your system.

edited Nov 16, 2019 at 12:08

Kusalananda

15.8k3 gold badges47 silver badges54 bronze badges

answered Jun 3, 2011 at 15:58

jathanism

33.9k9 gold badges72 silver badges89 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Ori Over a year ago

I recently had to do something similar for a splunk alert script. sudo is really made for this.

godlygeek Over a year ago

Note that editing the sudoers file should really be done with visudo, rather than any other arbitrary editor - otherwise it can lead to things like unix.stackexchange.com/questions/138237/…

Collectives™ on Stack Overflow

Running commands from within python that need root access

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related