launch ipython but not like root

Question

ipython is launched like root (UID); ok, but I need that after ipython cann't run and don't allow, script/code that can gain root privilegies. eg

I launch ipython, ok the UID is root. And in my visudo file I change:

root ALL=NOEXEC:/usr/bin/sudo
user ALL=NOEXEC:/usr/bin/sudo

And take off both users of sudoers.

So... I run the next code:

import subprocess
from subprocess import Popen, PIPE
COMMAND = "sudo apt-get install g++ -y" #In this line, you put the code that you want to run
proccess = Popen(COMMAND, shell=True, executable="/bin/bash", stdout=PIPE, stderr=PIPE)
result = proccess.communicate()
o, e = result

print "*"*100
print "Output"
print "*"*100
for i in o.split("\n"):
    print i

print "*"*100
print "Errors"
print "*"*100
for i in e.split("\n"):
    print i

I need that ipython cann't do it this. I more, if I quit off sudo from COMMAND; ipython allow me to do it!!!!

Please, help! Thanks!

Answer 1

After you launched an interpreter as root, it inevitably has root privileges. In order to drop privileges you could write a shell script wrapper where you change the process user and group and start the interpreter without privileges.

Solution 1: shell script wrapper

1. You need an unprivileged user which you can switch to (create one with sudo adduser --system --no-create-home [username] if necessary, but your login account should be fine)

2. start python with sudo su -c ipython [username] and check that it's unprivileged with

   import os
   os.getuid() # should be [username]'s UID
   os.geteuid() # should be [username]'s UID
   import subprocess
   subprocess.check_call(["sudo", "-i"]) # should raise CalledProcessError
   

This solution provides only sufficient flexibility for starting the interpreter. If you want to write code and deal with privileged and unprivileged parts, consider solution 2.

Solution 2: drop privileges in python

In case you want to manage privileges in the python interpreter:

The decision where to drop privileges in your code isn't trivial and needs to take into consideration the tradeoff between comfort (you don't want to enter your password all the time), security (as few code as possible should run with privileges) and maintainability (as much code as possible shouldn't be concerned with privileges).

Approaches:

• sudo offers a way to acquire privileges for a command in an unprivileged interpreter, but requires user interaction and makes it difficult to run your code without privileges (because you have the sudo statement in all you commands).
• If you start the interpreter with privileges you can drop privileges with os.set[/e/r/s]uid and os.set[/e/r/s]gid. The lecture of the python documentation is mandatory in this case.

In general you should write as much code as possible without having to deal with privileges and wrap the this code in a function which drops privileges, i.e. I don't recommend the sudo approach, also because it make the code dependent on sudo.