在 Linux 中，如何允许 Python 脚本访问受保护目录中的 mkdir 而无需 su 访问权限？
我正在尝试创建一个 python shell 脚本来在 Ubuntu Linux 中创建多个目录。我尝试在其中创建目录的主目录受到写访问保护。有没有办法允许Python脚本在那里创建目录，就好像它是root用户一样，但不必通过su运行脚本，因为其他用户可能需要运行脚本但不应该有su访问权限？
I'm trying to create a python shell script to create a number of directories in Ubuntu Linux. The main directory I'm trying to create directories in is protected from write access. Is there a way to allow the Python script to be allowed to create directories in there as if it's the root user but not have to run the script through su, since other users might need to run the script but should not have su access?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
这个问题其实和Python没有什么关系。 Python 脚本只是一个像任何其他进程一样的进程，需要拥有正确的权限才能执行操作。通常的方法是创建一个组，并将该组的父目录设为g+ws。然后将适当的用户添加到该组作为补充组。
This question is not really related to Python. The Python script is just a process like any other process and needs to have to right permissions to do things. The usual method is to create a group, and make the parent directory g+ws for that group. Then add the appropriate users to that group as a supplemental group.
不幸的是没有。 *nix 环境中进程的权限始终小于或等于触发它的人的权限。但这实际上是有道理的——允许进程超出用户自身的能力是一个巨大的安全风险。
这将需要有权访问该目录的人 - 通过他们的组之一或通过 sudo 。无论哪种方式，都需要在运行脚本的每台机器上进行人工交互。
就最简单的而言，您需要拥有该权限的人将其授予其他用户，或者直接使用 sudo 。
Unfortunately no. A process's permissions in a *nix environment are always less than or equal to the permissions of the person who fires it. This actually makes sense though -- it is a huge security risk to allow processes exceed the user's own abilities.
This will require someone who has access to that directory -- either through one of their groups or through
sudo. Either way, it will require human interaction on every machine that the script is run on.As far as what is easiest, well, you'll need someone who has that authority to grant it to another user, or simply use
sudodirectly.您可以仅为此任务添加一个用户，然后为该用户授予您想要在其中创建子目录的目录的权限，并以该用户身份执行脚本。
可能有更简单的解决方案，但这就是我第一眼想到的。
You could add a user just for this task, then give the said user permissions for the directory you want the subdirectories created in and execute the script as the said user.
There might be easier solutions but that's what comes to my mind at first glance.
您可以创建一个单独的命令来创建目录并将其设为 setuid root（或者更安全地，将 setuid 或 setgid 设置为父目录的所有者）。确保该命令不能执行您希望它执行的操作之外的任何操作（例如，不要让它将其参数传递给
system()）。然后从 Python 脚本调用该命令。当然，这也将使任何其他具有新命令执行权限的进程能够创建子目录。
You could create a separate command that creates the directory and make it setuid root (or, more safely, setuid or setgid to the owner of the parent directory). Make sure the command can't do anything other than what you want to allow it to do (e.g., don't let it pass its argument to
system()). Then invoke that command from your Python script.Of course this will also enable any other process with execute permission on the new command to create subdirectories.
您可以标记您的 Python 脚本 setuid，这使得它以 root 身份运行，无论哪个用户运行它。但请注意，这可能是一个主要的安全风险，因为如果用户找到一种方法让您的脚本执行其不打算执行的操作，那么他们可能会导致 root 权限受到损害。如果您确实使脚本 setuid，请确保它非常简单并且只做一件事，并进行大量错误检查以防止意外输入。 （查找 setuid 以获取有关执行此操作的更多信息；您需要使用 chmod 来标记可执行文件的 setuid 位。）
通常更好的解决方案是为要创建新目录的目录授予组权限，然后添加该权限将运行脚本的用户组。
您还可以在这两种解决方案之间进行折衷，方法是使脚本设置为 setuid，但在脚本的开头使其使用 root 权限来假定另一个用户的身份。然后，使用您已授予适当权限的其他用户的权限创建目录。这样，您仍然以用户无权直接执行操作的方式执行操作（因此他们必须使用脚本），但您可以最大限度地降低他们可能利用您的脚本进行操作的风险。做其他你没有预料到的事情。
我在这里找到了一篇关于编写 setuid 程序的不错的文章：
http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.124.384
You can mark your Python script setuid, which makes it run as root regardless of which user runs it. Be aware that this can be a major security risk, though, because if the user figures out a way to make your script do something it wasn't intended to do then they can potentially cause mischief with root privileges. If you do make your script setuid, make sure it's very simple and only does one thing, with plenty of error checking to prevent unexpected inputs. (Look up setuid for more info on doing this; you need to use chmod to mark the executable's setuid bit.)
What's often a better solution is to give a group permissions on the directory where you want to create new directories, and then add that group for users that will run the script.
You can also compromise between these two solutions by making your script setuid, but at the beginning of the script make it use its root privileges to assume the identity of another user. Then, create the directories using the privileges of that other user, to whom you've given the appropriate permissions. This way you're still performing the operation in such a way that users don't have permission to do it directly (so they must use the script), but you're minimizing the risk that they might be able to exploit your script to do assorted other things that you hadn't anticipated.
I found what looks to be a decent article about writing setuid programs here:
http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.124.384