Firefox execution fails from a root executed script with privilege drop

Question

I can't run firefox from a sudoed python script that drops privileges to normal user. If i write

# sudo python
>>> import os
>>> import pwd, grp
>>> uid = pwd.getpwnam('norby')[2]
>>> gid = grp.getgrnam('norby')[2]
>>> os.setegid(gid)
>>> os.seteuid(uid)
>>> import webbrowser
>>> webbrowser.get('firefox').open('www.google.it')
True
>>> # It returns true but doesn't work
>>> from subprocess import Popen,PIPE
>>> p = Popen('firefox www.google.it', shell=True,stdout=PIPE,stderr=PIPE)
>>> # Doesn't execute the command

I think that is not a python problem, but firefox/iceweasel/debian configuration problem. Maybe firefox read only UID and not EUID, and doesn't execute process because UID is equal 0. What do you think about?

But why are you trying to write a python script to be ran as root to do this. What is the objective? — theotherreceive, Jul 15 '09 at 20:27
The script works with network in a low level layer, so it must run as root. I think there is nothing wrong to drop privileges in the right way, and then execute firefox. But it doesn't works. — Emilio, Jul 15 '09 at 20:39
Does Python's `Popen` work with gui programs? Perhaps the problem is not where you think it is. — Telemachus, Jul 15 '09 at 20:55
Firefox will run as root, so the concern you have in the last part of your question isn't the issue. — Avery Payne, Jul 15 '09 at 20:56

Malfist · Answer 1 · 2009-07-15T20:44:25.253

1

The problem is it can't access the display on the X server, is it running? I wouldn't recommend running firefox with root permissions, that'd be like running IE on a windows box.

You said in a comment that you was launching it in a lower run level. The error is because you're launching firefox in that lower level before X comes up with an active display. Delay it's running until X is up.

edited Jul 15 '09 at 20:44

answered Jul 15 '09 at 20:29

Malfist

807
3
10
22

X server is running, and i'm not running firefox from root privilege, but i've dropped it to 'norby' normal user. – Emilio Jul 15 '09 at 20:43
is it running at execution time? – Malfist Jul 15 '09 at 20:45
sure! =) I'm not a linux newbie – Emilio Jul 15 '09 at 20:46
Can the user launch it normally? Can you launch it with fakeroot? – Malfist Jul 15 '09 at 20:48
Can you launch any windowed app with it, try something like gedit. – Malfist Jul 15 '09 at 20:50
Yes, the user can launch it normally. I don't want to use other external tools (except su-like programs to start the whole python script) – Emilio Jul 15 '09 at 20:50
@malfist: A command like 'sudo kwrite' works. I think the problem is about firefox that don't want to be executed from a user with UID==0 (also if EUID is >0 – Emilio Jul 15 '09 at 20:51
so change root's uid ;) – Malfist Jul 15 '09 at 20:55
backup the system first, it might break a few things – Malfist Jul 15 '09 at 20:55
Um, this should be interesting... – Telemachus Jul 15 '09 at 20:56
change root's uid? o.O I prefer to not waste my system =) – Emilio Jul 15 '09 at 20:59
It might not, it might work fine. Or, it could blow up. You could script it to change roots uid at the start of the script and then change it back after firefox is launched ;) – Malfist Jul 15 '09 at 21:01
@Malfist: I really hope that you are not serious. Changing root's uid in order to run a script (which may already have other problems) is an awful idea. Also, a commenter on the original question points out that Firefox _can_ (apparently) run as root. So this isn't even the issue. – Telemachus Jul 15 '09 at 21:09

score 1 · Accepted Answer · answered Jul 16 '09 at 02:34

1

You have to export environment variable named DISPLAY with value ':0.0'. That might make it work. Ask on stackoverflow if you don't know how to export environment variables using python.

answered Jul 16 '09 at 02:34

Saurabh Barjatiya

4,703
2
30
34

score 0 · Answer 3 · answered Jul 15 '09 at 19:56

0

You really really shouldn't do this. Like, really.

Why are you trying to?

answered Jul 15 '09 at 19:56

theotherreceive

8,365
1
31
44

Cian · Answer 4 · 2009-07-15T20:59:04.927

0

I'd guess, you'll have to specify an X-server. I'm afraid I have no idea how to actually do that in python though :-)

edited Jul 15 '09 at 20:59

answered Jul 15 '09 at 19:57

Cian

5,838
1
28
40

score 0 · Answer 5 · answered Jul 15 '09 at 20:26

0

First, you would normally want to use gksu or gksudo or sux to get root privileges for an X application. Second, why are you using sudo on Debian? (I mean is sudo even enabled? It's not by default on Debian, as opposed to Ubuntu or OS X.) Third, I can't think of any circumstance where you actually need to run a browser with root privileges.

There are cases when you need a gui application as root - say, you want to edit a system file (/etc/network/interfaces for example), and you're most comfortable editing with gedit. That's not an unreasonable thing to want to do. But you would want to use gksu or a similar utility to transfer the privileges.

answered Jul 15 '09 at 20:26

Telemachus

571
2
11

yes, sudo is enabled, but no one is a sudoer – Malfist Jul 15 '09 at 20:28
@Malfist: 6 of one; half-dozen of the other. I take your point, but since in fact many Debian users don't install the Desktop task at all, `sudo` is often not even installed. Nevertheless, I grant that if you install the Gnome (or KDE or XFCE, I suppose) packages, then `sudo` gets installed. It's still not the right tool to get gui privileges. – Telemachus Jul 15 '09 at 20:31
Sudo is installed in debian system. I have to execute a browser from a python script that must run as root. I'm only trying to drop privilege and run the browser. Nothing dangerous. – Emilio Jul 15 '09 at 20:32
@Emilio: First, the whole Python script-which-must-be-root -> Firefox idea _still_ sounds like a bad idea. Second, are you sure that your regular user is in the `sudoers` file? Again, Debian is _not_ Ubuntu. Even if you run Gnome, I don't think that regular users are automatically added to the list of users who can run `sudo`. I believe that out of the box in Debian only root can. – Telemachus Jul 15 '09 at 20:34
Sudo is not the problem (the user will execute the program as he want, with sudo, gtksudo, kdesudo, etc.), but the problem is that the browser don't works even if i drop privileges in the right way.. – Emilio Jul 15 '09 at 20:37
sudo is installed without the a windowing system. The Debian box I've been working on is a server and it doesn't have X. – Malfist Jul 15 '09 at 20:37
@Malfist: I'm not sure what it's a dependency of then. If you install Debian selecting _only_ the Standard task from the Tasksel menu in the installer, `sudo` is not installed. See here for the list of packages in the Standard task. When I run `aptitude why sudo`, I can track back and see that the only reason I have it installed is that I installed `pcmanfm`, which recommends `gksu` which requires `sudo`. – Telemachus Jul 15 '09 at 20:51
Is not a sudo problem =) I want only to execute firefox after dropping privileges. – Emilio Jul 15 '09 at 20:52
Oops: I forgot the link to the list of packages: http://wiki.debian.org/tasksel – Telemachus Jul 15 '09 at 20:52
@Emilio: that's fine, but now I'm in a debate because "someone is _wrong_ on the internet." http://xkcd.com/386/ – Telemachus Jul 15 '09 at 20:54
@Tele: ahahha ok =) – Emilio Jul 15 '09 at 20:54

score 0 · Answer 6 · answered Jul 15 '09 at 20:32

0

I use sux.

apt-get installl sux
sux firefox

Description: wrapper around su which will transfer your X credentials Sux is a wrapper around the standard su command which will transfer your X credentials to the target user.

answered Jul 15 '09 at 20:32

Yordan

106
3

I prefer to find a solution not based on what *su program is used, but to try to run firefox from the script executed by root, but with dropped privileges – Emilio Jul 15 '09 at 20:47

Firefox execution fails from a root executed script with privilege drop

6 Answers6