“不允许操作”关于使用 os.setuid( ) [python]
我正在尝试构建一个平台来启动一些脚本。该脚本放置在每个用户的主文件夹中。每次启动都应该使用每个用户 ID 来完成，因此，我正在为每个用户执行以下操作：
user_id = pwd.getpwnam( user )[ 3 ]
user_home = pwd.getpwnam( user )[ 5 ]
os.chdir( user_home )
os.setuid( user_id )
subprocess.Popen( shlex.split( "user_script.py" ) )
但是，当 python 尝试执行 os.setuid( user_id ) 时，它会引发此异常：
Traceback (most recent call last):
File "launcher.py", line XX, in <module>
OSError: [Errno 1] Operation not permitted
顺便说一下，启动此脚本的用户位于 root 组中（在 GNU/linux 操作系统上），并且拥有所有 root 权限。
如果我尝试使用 root 用户启动相同的代码，则会收到不同的错误：
OSError: [Errno 13] Permission denied
如果有人可以帮助我了解发生了什么，请...
I'm trying to build a platform to launch some scripts. This scripts are placed in home folder of each user. Every launch should be done with each user id so, I'm doing, for each user, this:
user_id = pwd.getpwnam( user )[ 3 ]
user_home = pwd.getpwnam( user )[ 5 ]
os.chdir( user_home )
os.setuid( user_id )
subprocess.Popen( shlex.split( "user_script.py" ) )
But, when python trys to do os.setuid( user_id ) it raise this exception:
Traceback (most recent call last):
File "launcher.py", line XX, in <module>
OSError: [Errno 1] Operation not permitted
By the way, the user who starts this script is in the root group (on GNU/linux OS) and it has all the root privileges.
If I try to launch the same code with root user I get a different error:
OSError: [Errno 13] Permission denied
If someone can help me to understand what's happening please...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
只有 root 可以执行 setuid，仅在 root 组中是不够的。
Only root can do a setuid, being in the root-group is not enough.
只有超级用户可以随时更改 uid，仅将用户添加到 root 组是不够的。
例如
setuid(2)提到：在 Linux 上，还有：
我什至不知道 Python 是否直接实现了这个，但无论如何它并不完全是你想要的。
所以简短的答案是：以 root 身份启动初始进程。
如果您担心安全性，请启动两个进程，一个作为 root，一个作为非特权用户，并让非特权进程通过套接字与 root 进程进行通信。不过，这是一个更高级的设置......
Only superuser can change uid whenever it feels like it, just adding the user to the root group is not enough.
setuid(2)for example mentions:On Linux, there's also:
I don't even know if Python directly implements this, but it's not exactly what you want anyway.
So the short answer is: Start the initial process as root.
If you're worried about security, start two processes, one as root, one as non-privileged user, and have the non-privileged process communicate with the root process with a socket. This is a more advanced setup though...
OSError: [Errno 1] Operation not allowed表示启动脚本的用户权限不足。位于根组中还不够，它实际上需要CAP_SETUID功能。OSError: [Errno 13] Permission returned可能是一个不相关的错误。你应该看看它的堆栈跟踪。OSError: [Errno 1] Operation not permittedindicates the user who starts the script has insufficient privileges. Being in the root group is not enough, it actually needs theCAP_SETUIDcapability.OSError: [Errno 13] Permission deniedis probably an unrelated error. You should have a look at its stacktrace.这条线
在很多方面让我感到困惑。
shlex.split()似乎是多余的，因为没有什么可分割的。Popen()的参数放在列表中。user_script.py没有执行权限，即使root也无法执行此操作。The line
confuses me in manifold ways.
shlex.split()seems to be redundant, as there is nothing to split.Popen()'s parameter in a list.user_script.pyhas no execute permissions, even root cannot do that.您还使用 setuid 权限。也就是说，
现在即使是普通用户，如果您执行该程序，它也会切换为特定用途。您不会遇到任何权限问题。
you also use setuid permission . That is give ,
Now even from normal user if you execute the program it will switch as that particular use. You won't get any permission issues .