Django 和根进程
在我的 Django 项目中，我需要能够使用 ICMP ping 检查 LAN 上的主机是否启动。我发现这个SO问题它回答了如何在Python中ping某些东西和这个问题链接到解释资源如何使用 sodoers 文件。
设置
Device 模型存储 LAN 上主机的 IP 地址，并在将新的 Device 实例添加到数据库后（通过自定义视图，而不是管理员）我设想使用 AJAX 调用公开该功能的 API 来检查设备是否响应 ping。
问题
但是（来自第一个 SO 问题中建议的库的文档字符串）“请注意，ICMP 消息只能从以 root 身份运行的进程发送。”
我不想以 root 用户身份运行 Django，因为这是不好的做法。然而，这部分过程（发送和 ICMP ping）需要以 root 身份运行。如果使用 Django 视图，我希望发送 ping 数据包来测试主机的活动性，那么 Django 本身需要以 root 身份运行，因为这是调用 ping 的进程。
解决方案
这些是我能想到的解决方案，我的问题是有没有更好的方法来仅以 root 身份执行 Django 项目的选定部分，除了这些：
- 以 root 身份运行 Django （请不要！ ）
- 将“ping 请求”放入另一个进程（以 root 身份运行）可以定期检查和执行的队列中。也许像 celery 之类的东西。
难道就没有更简单的方法吗？
我想要一个类似“Django 以 root 身份运行”的库，这可能吗？
In my Django project I need to be able to check whether a host on the LAN is up using an ICMP ping. I found this SO question which answers how to ping something in Python and this SO question which links to resources explaining how to use the sodoers file.
The Setting
A Device model stores an IP address for a host on the LAN, and after adding a new Device instance to the DB (via a custom view, not the admin) I envisage checking to see if the device responds to a ping using an AJAX call to an API which exposes the capability.
The Problem
However (from the docstring of a library suggested in the the first SO question) "Note that ICMP messages can only be sent from processes running as root."
I don't want to run Django as the root user, since it is bad practice. However this part of the process (sending and ICMP ping) needs to run as root. If with a Django view I wish to send off a ping packet to test the liveness of a host then Django itself is required to be running as root since that is the process which would be invoking the ping.
Solutions
These are the solutions I can think of, and my question is are there any better ways to only execute select parts of a Django project as root, other than these:
- Run Django as root (please no!)
- Put a "ping request" in a queue that another processes -- run as root -- can periodically check and fulfil. Maybe something like celery.
Is there not a simpler way?
I want something like a "Django run as root" library, is this possible?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
绝对不行，不要以 root 身份运行 Django 代码！
我将以 root 身份运行一个守护进程（用 Python 编写，为什么不），然后在 IPC 之间运行Django 实例和您的守护进程。只要您确定验证内容并正确处理它（例如将 subprocess.call 与数组等一起使用）并且仅传递数据（而不是要执行的命令），就应该没问题。
这是一个示例客户端和服务器，使用 web.py
服务器： http://gist.github.com/788639
客户端： http://gist.github.com/788658
您需要安装 webpy.org，但是无论如何，它还是值得拥有的。如果您可以将 IP（或主机名）硬连接到服务器并删除参数，那就更好了。
Absolutely no way, do not run the Django code as root!
I would run a daemon as root (written in Python, why not) and then IPC between the Django instance and your daemon. As long as you're sure to validate the content and properly handle it (e.g. use
subprocess.callwith an array etc) and only pass in data (not commands to execute) it should be fine.Here is an example client and server, using web.py
Server: http://gist.github.com/788639
Client: http://gist.github.com/788658
You'll need to install webpy.org but it's worth having around anyway. If you can hard-wire the IP (or hostname) into the server and remove the argument, all the better.
你这里的操作系统是什么？您也许可以编写一个小程序，在给定参数的情况下执行您想要的操作，并将其粘贴在 sudoers 文件中，并授予您的 django 用户以 root 身份运行它的权限。
/etc/sudoers
What's your OS here? You might be able to write a little program that does what you want given a parameter, and stick that in the sudoers file, and give your django user permission to run it as root.
/etc/sudoers
我不知道你使用的是哪种系统，但是在我遇到的任何机器上，不必是 root 即可运行命令行
ping程序（它具有 suid位设置，因此它根据需要成为根）。所以你可以调用它。这会增加一点开销，但与网络延迟相比可能可以忽略不计。I don't know what kind of system you're on, but on any box I've encountered, one does not have to be root to run the command-line
pingprogram (it has the suid bit set, so it becomes root as necessary). So you could just invoke that. It's a bit more overhead, but probably negligible compared to network latency.