1

I want to sudo a command from a pythonscript without hardcoding my password in it. The Pythonscript is part of a webservice on Apache2. Since it is part of a webservice, asking the user each time for the password is not an option, neither is giving full rights to the entire folder.

The command should execute a compiled C++ file (whose name is stored in the variable "CMDexecutable"). This compiled C++ file is located in a temporary folder that is being created as part of the service with a random name. The path is stored in the variable "rundir_temp". This directory is freely accessable over the web.

Now, I have the following in my Pythonscript :

Popen(os.path.join(rundir_temp,CMDexecutable),stdout=PIPE)

This does not execute the script I have. I can only execute the compiled C++ file by typing the following in the terminal while in the "rundir_temp" directory:

sudo ./CMDexecutable

Everything works perfectly then.

How can I give sudo rights to this command in my Pythonscript without hardcoding my password?

I found this thread which discusses a very similar topic, but I just can't get it working... I'm new to both Python and Ubuntu, so probably overlooking a basic thing?

I have Ubuntu 14.04 LTS and Python 2.7.6

Thanks in advance!!

1 Answer 1

0

From your question, it is not fully clear if you need to be inside the directory of CMDexecutable (and thus cd first) or if the full path would do, but the only option I see is to add the script to the sudoers file, as described here.
Then you can run the script with sudo, without having to enter the password.
You can simply run the (python) script then by the command

sudo <script>

as said, without being prompted for the password.

(Very) important note

It is quite evident that you need to store the script in a location where it can not be edited without sudo privileges. Since the script can run without entering the password, you need to be sure its content is not changed by any other process or possibly malicious code.

Furthermore, (might be superfluously, but since I do not know the exact context) for the same reason, you need to make absolutely sure that the CMDexecutable and everything it runs is no possible target for "malicious alterations".

Edit

Since you mention you cannot change the initial command to run your python script into a sudo command, you could do the following:

  • Inside your python script, create a command to run a secondary script, run with sudo:

      sudo <script>
    
  • Add this secondary script to the sudoers file, to run without password. This way, the python (main) script will run the command without having to enter the password.

I'd like to stress however that this seems patchwork, and I have no insight in possible security risks. Make anyway sure all files, run from the thread of the first sudo command "tree" are no possible targets for malicious editing.

2
  • Thanks for the suggestion! Unfortunately, I cannot run the script as sudo <script>, because the script itself is called as a service from a WPS engine (more precisely this one: zoo-project.org). This WPS engine is a .cgi-file which I cannot edit. Is it possible to combine the "sudo" command with the Popen statement above? Feb 2, 2016 at 7:33
  • @SgtPepper88 posted an addition, let me know if it works. Feb 2, 2016 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .