7

I have the following script:

#!/usr/bin/env python                                                           

import sys                                                                      
import pyttsx                                                                   

def main():                                                                     
        print 'running speech-text.py...'                                       
        engine = pyttsx.init()                                                  
        str = "Hi..."                                    
        if len(sys.argv) > 1:                                                   
                str = sys.argv[1]                                               
        engine.say(str)                                                         
        engine.runAndWait()                                                     

if __name__ == '__main__':                                                      
        main()

and I have placed it in /usr/bin/speech-test.py

I have also given it executable permissions and ownership to root:

sudo chown root:root /usr/bin/speech-test.py
sudo chmod 4755 /usr/bin/speech-test.py

However, this script will only run correctly if I run as sudo speec-test.py. If I try to run it as just speech-test.py it complains about not finding a bunch of ALSA lib files.

Am I missing something to have my script run with root privileges?

moesef
  • 4,641
  • 16
  • 51
  • 68
  • The problem might be with `env` in hashbang, but I need to test it. You call it like `./speech-test.py`, not by `python speech-test.py`? Because later would run python still with user rights. – m.wasowski Mar 22 '14 at 06:28
  • just `speech-test.py` no ./ – moesef Mar 22 '14 at 06:34
  • 3
    You can't SUID scripts on linux. If you need it, write a binary launcher or use nopasswd sudo. Anything executable that starts with a hashbang is a script. – x3al Mar 22 '14 at 06:41
  • 1
    TIL: http://stackoverflow.com/questions/18698976/suid-not-working-with-shell-script + http://www.faqs.org/faqs/unix-faq/faq/part4/section-7.html Thanks @x3al – m.wasowski Mar 22 '14 at 06:43
  • unrelated: have you tried [`espeak`](http://stackoverflow.com/a/11270665/4279)? – jfs Mar 22 '14 at 08:20
  • 1
    If you don't want to use nopasswd sudo then you could create a binary executable from a Python script using something like [cx_Freeze](http://cx-freeze.readthedocs.org/en/latest/). – jfs Mar 22 '14 at 08:21
  • I will look into espeak. Also, will look into cx_Freeze although I just made my own binary wrapper and that fixed the issue. – moesef Mar 22 '14 at 23:04

4 Answers4

13

So you want the script to run as root, even without sudo? For that you would need to set the setuid bit on the script with sudo chmod u+s program. However, most Unix distributions allow this only for binaries, and not for scripts, for security reasons. In general it's really not a good idea to do that.

If you want to run this script as root, you will have to run as sudo. Or, you have to create a binary that runs your script, so that you can set the setuid bit on this binary wrapper. This related question explains more.

It's also a good idea to check the effective uid, and if it's not root then stop running. For that, add this near the top (thanks @efirvida for the tip!)

if not os.geteuid() == 0:
    sys.exit("\nOnly root can run this script\n")

ORIGINAL ANSWER

Maybe your user and root use a different version of python, with different python path, and different set of libraries.

Try this:

command -v python
sudo command -v python

If the two commands don't give the same result then you either need to change the setup of the users to use the same version of python (the one that has the ALSA libs), or hardcode the python version the first line of the script.

Also try adding a print sys.path line in the script, and run with your user and with sudo and compare. Probably you'll get different results. You may need to tweak the PYTHONPATH variable of your user.

It shouldn't be necessary to make the owner of the script root, and to run it with sudo. You just need to configure python and PYTHONPATH correctly.

jww
  • 97,681
  • 90
  • 411
  • 885
janos
  • 120,954
  • 29
  • 226
  • 236
  • 1
    `which` was changed to `command -v`. There are several reasons to use `command -v` over `which`. Please revert if you don't want the change. Also see [How to check if command exists in a shell script?](https://stackoverflow.com/q/7522712/608639) and [How to check if a program exists from a Bash script?](https://stackoverflow.com/q/592620/608639) – jww Aug 22 '19 at 04:22
  • Unless packages are installed globally (accessible to sudo) this won't work, and there is a trend to keep packages local. – PeterT Mar 25 '21 at 00:07
0

I'm not really sure if this is a great method. I tried it and it works fine on arch linux. Let me what you think. If you write a script to execute the .py as different system group, that group can own a python interpreter and have specified root capabilities.

mkdir roottest && cd roottest
sudo cp /usr/bin/python<ver> ./
sudo groupadd -r rootpython
sudo usermod -a -G rootpython <user>
newgrp rootpython
sudo chown root:rootpython python<ver>
sudo chmod 750 $bin                       #that way a normal user can't rwx the python interpreter and the rootpython group cant write.
sudo setcap <caps> ./python<ver>              #now the group has specify caps allowing it to act like root
sudo getcap ./python<ver>
sudo sh
touch rootfile && echo "original text" > rootfile

open a new prompt as regular user

newgroup rootpython
cd roottest && ./python<ver>
>> open('rootfile', 'w').write("different text")
sudo cat rootfile

This method is way more secure than sudo if used properly because python can only do what you let it and does not have complete control of the system. The downside is having to either make a copy of the interpreter or to not allow the regular user's group to use it. DO NOT run all your python code like this, its a big vulnerability if not needed. The cap_net_admin+ep will allow you to change the kernal var ip_forward and for the example above you need cap_dac_override+ep. You can also create a newuser that belongs to the rootpython group, that way you can't just newgrp rootpython without entering the newuser's password.

JimiMyFr13nd
  • 1
  • 1
0

Idk but replacing #!/usr/bin/env python by #!/bin/python worked for me.

hDmtP
  • 51
  • 1
  • 2
  • 1
    Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Jan 29 '22 at 19:49
  • (Ubuntu 22.04) This didn't work for me. I get the same "Permission Denied" error. – lonelyjoe Mar 19 '22 at 12:29
  • Do you have multiple python interpreters? If yes, then u may need to specify the version like `python3` – hDmtP Mar 20 '22 at 13:06
-4

Its running privilege is the same as the one who ran it. So if you ran it as yourself, it won't have su privilege. You have to do it sudo.

Hot.PxL
  • 1,902
  • 1
  • 17
  • 30