My sudo file has two commands in it right now that are allowed to run without logging in as root.
It looks like this:
user ALL=(root) NOPASSWD: /home/user/prog1.py
user ALL=(root) NOPASSWD: /home/user/prog2.py
The prog1.py
file runs fine without password needed. The prog2.py
file fails on permissions denied?
The first program is only accessing a file to read that is root protected. The second program is creating a symlink and removing a root-protected file:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
import os
from random import choice
from subprocess import Popen
def back_drop_change():
link = "/usr/share/slim/themes/default/background.jpg"
os.remove(link) # this is the line that returns permission denied
image_selection = list()
for di, _, fi in os.walk("/home/user/pictures/apod"):
for f in fi:
image_selection.append(di + "/" + f)
bck_img = choice(image_selection)
Popen(["ln", "-s", bck_img, link])
if __name__ == "__main__":
back_drop_change()
I try adding /usr/bin/rm /usr/share/slim/themes/default/background.jpg
to the visudo file but, it still fails?
EDIT:
Some extra information --
sudo -l
returns:
Matching Defaults entries for user on this host:
env_reset, editor="/usr/bin/vim -p -X", !env_editor
User user may run the following commands on this host:
(ALL) ALL
(root) NOPASSWD: /home/user/Pidtrk/main.py
(root) NOPASSWD: /home/user/backdrop.py
and again, I am able to run python2 Pidtrk/main.py
without errors but, not
python2 backdrop.py
.
And both these files are owned by the same User
and have the same Permissions
.
EDIT 2:
I have both of prog1.py
and prog2.py
running in a crontab
on @reboot
.
If I have this line in crontab
:
`python2 /home/user/prog1.py >> err.log 2>&1`
without:
user ALL=(root) NOPASSWD: /home/user/prog1.py
Inside my sudoers file, the err.log shows it failed with permissions denied
.
Now when I add in this line to sudoers:
user ALL=(root) NOPASSWD: /home/user/prog1.py
The prog1.py
runs fine on reboot, why is this any different for the prog2.py
file?
/home/user/prog2.py
? In particular, is it marked executable? – tripleee May 27 '13 at 17:37rm
tosudoers
; once you manage to runprog2.py
as root, all its child processes will inherit the root permissions (unless you take explicit steps to drop privileges; complex scripts should do this in order to minimize the amount of privileged code). – tripleee May 27 '13 at 17:40ls -l /home/user/prog2.py
and look at the farthest-left column. Or, post the output ofstat -c '%A %a %u' /home/user/prog2.py; id
here. – user26112 May 27 '13 at 18:00