Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm creating a small router program (GTK frontend) in python for some of our less CLI savvy users. I've developed the glade front-end and able to connect the various signals. Now, I'm facing only one issue which is to create the 'sudo' interface.

For some reasons, we don't want the user to start the program using gksu, but instead provide him a password dialog that is later stored in the program (similar to what happens with synaptic package manager).

Trouble is that the script works fine when I tested on GNOME 3 desktop where I developed it, but on ubuntu the gksu command is not saving anything to keyring. Instead, it asks password for each command! Here is the function in the program that calls gksu:

def execute(command,errorstring='', wait = True, shellexec = True):
    try:
        print 'command=' + command
        p=subprocess.Popen("gksu '" + command + "'", shell=shellexec,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
        if wait:
            p.wait()
            result=get_stdout(p)
            return result
        else:
            print 'not waiting'
            return p
    except subprocess.CalledProcessError as e:
        print 'error occured:' + errorstring
        return errorstring

And here is an example of how I call the execute function in some parts of my program:

#stop hostapd if already running.
if is_process_running('hostapd')>0:
    writelog('stopping hostapd')
    **execute('killall hostapd')**

#enable forwarding in sysctl.
writelog('enabling forward in sysctl.')
set_sysctl('net.ipv4.ip_forward','1')

How do I go about it so that the gksu call stores password in the keyring or something and doesn't bother user each time ?

share|improve this question
    
It is technically a very big risk to allow a script to call sudo to gain superuser abilities every time from inside the script. If the script needs to execute something as sudo, the script should be run as sudo instead, and have checks to make sure that the script is running as the superuser (with sudo) rather than execute the command inside the script using sudo or similar. (sudo and variants are interchangeable here) –  Thomas W. Jan 14 at 17:13
    
Why the downvote? Please explain... –  Rmano Jan 14 at 17:17
    
@ThomasW. Why?. I would like a rational. My guts tell me that the least code that is run as root the least the risk. –  Javier Rivera Jan 15 at 8:04
1  
Maybe the GtkLockButton is of any use: developer.gnome.org/gtk3/3.10/GtkLockButton.html –  Timo Jan 15 at 12:21
    
@Timo - Sounds good!! I'll try and see how this works with python-gtk and Glade. –  Prahlad Yeri Jan 15 at 18:19

1 Answer 1

up vote 3 down vote accepted

Not sure about this, but probably you'll need to disable the option "tty_tickets" in /etc/sudoers. Normally the "grace period" of sudo not asking for a password again is bound to the tty, see the manual.

Warning --- this could be a security threat.

Basically you should add to the option

Defaults   !tty_tickets

in your /etc/sudoers files (you know how to do it, otherwise better no doing it). A lot of info is found in the arch linux wiki. Notice that after that, during the grace period, all the user applications can gain privileges without asking for a password...

The other strategy is to request the whole script to be run under sudo. If you are worried about running all time with root privileges, you can drop them and use them only when needed using os.seteuid().

Interesting links here and here.

Another strategy is to make the program setuid (you have to use some trick to do it, see the links in the answer --- it's for bash, the same stands for python), and then use for example groups if you want to restrict the access to the user (or drop privileges and then re-enable it after asking for a password).

share|improve this answer
    
Many thanks for the response Rmano! However, I'd rather prefer a solution that works out of the box on an ubuntu machine (since most of our users use it) without having to do any configuration changes on each machine. –  Prahlad Yeri Jan 14 at 17:42
    
If there is no other way, I'm also inclined to let go of the "dont start as sudo" rule, effectively asking the users to start it as sudo. I'm just trying to see if there is a way to run this without going to the CLI (like synaptic package manager for instance. It does precisely this, though I'm not sure whether its written in python). –  Prahlad Yeri Jan 14 at 17:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.