Run child processes as different user from a long running Python process

Since you mentioned a daemon, I can conclude that you are running on a Unix-like operating system. This matters, because how to do this depends on the kind operating system. This answer applies only to Unix, including Linux, and Mac OS X.

1. Define a function that will set the gid and uid of the running process.
2. Pass this function as the preexec_fn parameter to subprocess.Popen

subprocess.Popen will use the fork/exec model to use your preexec_fn. That is equivalent to calling os.fork(), preexec_fn() (in the child process), and os.exec() (in the child process) in that order. Since os.setuid, os.setgid, and preexec_fn are all only supported on Unix, this solution is not portable to other kinds of operating systems.

The following code is a script (Python 2.4+) that demonstrates how to do this:

import osimport pwdimport subprocessimport sysdef main(my_args=None):    if my_args is None: my_args = sys.argv[1:]    user_name, cwd = my_args[:2]    args = my_args[2:]    pw_record = pwd.getpwnam(user_name)    user_name      = pw_record.pw_name    user_home_dir  = pw_record.pw_dir    user_uid       = pw_record.pw_uid    user_gid       = pw_record.pw_gid    env = os.environ.copy()    env[ 'HOME'     ]  = user_home_dir    env[ 'LOGNAME'  ]  = user_name    env[ 'PWD'      ]  = cwd    env[ 'USER'     ]  = user_name    report_ids('starting ' + str(args))    process = subprocess.Popen(        args, preexec_fn=demote(user_uid, user_gid), cwd=cwd, env=env    )    result = process.wait()    report_ids('finished ' + str(args))    print 'result', resultdef demote(user_uid, user_gid):    def result():        report_ids('starting demotion')        os.setgid(user_gid)        os.setuid(user_uid)        report_ids('finished demotion')    return resultdef report_ids(msg):    print 'uid, gid = %d, %d; %s' % (os.getuid(), os.getgid(), msg)if __name__ == '__main__':    main()

You can invoke this script like this:

Start as root...

(hale)/tmp/demo$ sudo bash --norc(root)/tmp/demo$ ls -ltotal 8drwxr-xr-x  2 hale  wheel    68 May 17 16:26 inner-rw-r--r--  1 hale  staff  1836 May 17 15:25 test-child.py

Become non-root in a child process...

(root)/tmp/demo$ python test-child.py hale inner /bin/bash --norcuid, gid = 0, 0; starting ['/bin/bash', '--norc']uid, gid = 0, 0; starting demotionuid, gid = 501, 20; finished demotion(hale)/tmp/demo/inner$ pwd/tmp/demo/inner(hale)/tmp/demo/inner$ whoamihale

When the child process exits, we go back to root in parent ...

(hale)/tmp/demo/inner$ exitexituid, gid = 0, 0; finished ['/bin/bash', '--norc']result 0(root)/tmp/demo$ pwd/tmp/demo(root)/tmp/demo$ whoamiroot

Note that having the parent process wait around for the child process to exit is for demonstration purposes only. I did this so that the parent and child could share a terminal. A daemon would have no terminal and would seldom wait around for a child process to exit.

There is an os.setuid() method. You can use it to change the current user for this script.

One solution is, somewhere where the child starts, to call os.setuid() and os.setgid() to change the user and group id and after that call one of the os.exec* methods to spawn a new child. The newly spawned child will run with the less powerful user without the ability to become a more powerful one again.

Another is to do it when the daemon (the master process) starts and then all newly spawned processes will have run under the same user.

For information look at the manpage for setuid.

Actually, example with preexec_fn did not work for me.
My solution that is working fine to run some shell command from another user and get its output is:

apipe=subprocess.Popen('sudo -u someuser /execution',shell=True,stdout=subprocess.PIPE)

Then, if you need to read from the process stdout:

cond=Truewhile (cond):  line=apipe.stdout.getline()  if (....):    cond=False

Hope, it is useful not only in my case.