What is the appropriate way to run higher privilege commands via over HTTP

Question

I have a web project for which I need to run a command when a specific URL is requested, but that command requires root privileges.

The project is served with a Python process (Django), of course running it with root privileges is not an option.

The command's parameters are hardcoded making it impossible to inject anything and it's a right protected application so I can be slightly more liberal on security since the users who will have access to it will be trustworthy (hopefully). However ideally I would like to do it securely.

.

Answer 1

Use setuid: http://en.wikipedia.org/wiki/Setuid

"setuid and setgid (short for set user ID upon execution and set group ID upon execution, respectively) are Unix access rights flags that allow users to run an executable with the permissions of the executable's owner or group."

...And be very, very careful!

Answer 2

Call out to the command via sudo with the NOPASSWD: option, that allows you fine grained access control and gives you auditing in syslog for free. Avoid using a shell and use an exec variant that takes the parameters directly as array.

Answer 3

By all means avoid using setuid and setgid, you want to keep the HTTP server with as low permissions as possible. For the process that requires root privileges, use the http server to create a whole new separate process and invoke sudo. You should however not include the HTTP server uid or gid in the sudoers, but some other user that is the only one that can access the program, and that program is the only one that can run as root. The HTTP SERVER then starts a new process, it changing the UID to the dumb user and then executes the process with sudo as root.