challenging problem for changing to a dedicated non-privileged user within a script.

[Piet van Oostrum]

>>>>> Krishnakant <hackingkk at gmail.com> (K) wrote:

>K> On Thu, 2009-07-23 at 00:17 +0200, Piet van Oostrum wrote:
>>> Being a sudoer is not a privilege to issue the os.setuid system call. It
>>> is only a permission to use the sudo command.
>>> 
>K> Yes, So I would like to know if python can change the user to some other
>K> non-privileged user during the script execution?

As I said you can't (unless you are root). It would be a security leak if
an arbitrary user could suddenly run as another user. Sudo is the escape
mechanism but it runs commands, and is not for changing the uid in the
middle of a process.

>>> >K> I tryed using subprocess but that did not help me either.  I tryed sudo
>>> >K> su into the Popen command but it throws me into the terminal (shell)
>>> >K> with postgres as the user.
>>> 
>>> You could execute the command:
>>> sudo -u postgres required_command
>>> with subprocess.
>>> 
>K> Ok, but the problem is much more complex.
>K> What if I want to do the following.
>K> 1, change the user for a particular script to the postgres user.
>K> 2. now execute the python code for connecting to the postgresql
>K> database.
>K> In the second point I actually want to execute python code not shell
>K> level command so will the sudo -u in the subprocess.Popen change the
>K> user in the script?

You can run another python script as the other user (o even the same
python script). You said you tried subprocess. If that is acceptable
then running another python script should also be acceptable, becaus eit
is basically the same.

>K> In short I would just like to have the script run under another user
>K> let's say postgres as long as a certain action is going on, for example
>K> connecting to the postgresql database.

Why would you have to be another user for connecting to a postgres
database? The DBMS takes care of the permissions at the DB level.

Otherwise you would have to do the DB access in another script. The
script could even communicate withe the original script, e.g by pipes or
some protocol like XMLRPC.
-- 
Piet van Oostrum <piet at cs.uu.nl>
URL: http://pietvanoostrum.com [PGP 8DAE142BE17999C4]
Private email: piet at vanoostrum.org