python subprocess command not executed successfully when invoked from webserver

Question

I have a sample file called test.py

import subprocess, sys
from pyroute2 import netns
import subprocess32
import logging
cmd = "ping 192.168.121.1 -I enp5s0"

logFile = "TestLog.txt"
logging.basicConfig(filename = logFile,level=logging.DEBUG,
                    format='%(asctime)s [%(filename)s:%(lineno)s - %(funcName)s]%(levelname)s %(message)s',
                                        datefmt='%m/%d/%Y %I:%M:%S %p')

def ping():
    try:
        subprocess32.check_output(cmd, shell=True, timeout = 10)
    except subprocess32.TimeoutExpired as ex:
        logging.info("Duration completed")
        logging.info(ex.output)
    except Exception as ex:
        template = "ERROR: An exception of type {0} occurred. Arguments:{1!r}"
        message = template.format(type(ex).__name__, ex.args)
        logging.info(message)

def addNamespace(namespace):
    setNs = "ip netns add %s"%(namespace)
    logging.info(setNs)
    proc = subprocess.Popen(setNs.split(' '))
    ret = proc.communicate()
    logging.info("Return Code:%d STDOUT/STDERR:%s"%(proc.returncode, str(ret)))
    logging.info(netns.listnetns())


if __name__ == '__main__':
   ping()
   addNamespace('b01s')

When I run this from the command line python test.py, i get the expected output in the logfile as:

08/16/2017 11:25:52 AM [test.py:16 - ping]INFO Duration completed
08/16/2017 11:25:52 AM [test.py:17 - ping]INFO PING 192.168.121.1 (192.168.121.1) from 192.168.121.75 enp5s0: 56(84) bytes of data.
64 bytes from 192.168.121.1: icmp_seq=1 ttl=255 time=0.316 ms
64 bytes from 192.168.121.1: icmp_seq=2 ttl=255 time=0.256 ms
64 bytes from 192.168.121.1: icmp_seq=3 ttl=255 time=0.276 ms
64 bytes from 192.168.121.1: icmp_seq=4 ttl=255 time=0.261 ms
64 bytes from 192.168.121.1: icmp_seq=5 ttl=255 time=0.276 ms
64 bytes from 192.168.121.1: icmp_seq=6 ttl=255 time=0.278 ms
64 bytes from 192.168.121.1: icmp_seq=7 ttl=255 time=0.366 ms
64 bytes from 192.168.121.1: icmp_seq=8 ttl=255 time=0.278 ms
64 bytes from 192.168.121.1: icmp_seq=9 ttl=255 time=0.306 ms
64 bytes from 192.168.121.1: icmp_seq=10 ttl=255 time=0.268 ms

08/16/2017 11:25:52 AM [test.py:25 - addNamespace]INFO ip netns add b01s
08/16/2017 11:25:52 AM [test.py:28 - addNamespace]INFO Return Code:0 STDOUT/STDERR:(None, None)
08/16/2017 11:25:52 AM [test.py:29 - addNamespace]INFO ['b01s']

However, when I invoke the same code through lighttpd server on linux, I get the following :

08/16/2017 11:22:11 AM [test.py:21 - ping]INFO ERROR: An exception of type CalledProcessError occurred. Arguments:()
08/16/2017 11:22:11 AM [test.py:25 - addNamespace]INFO ip netns add b01s

I am running the python script through cgi (lighttpd), to configure cgi in lighttpd:

Add in modules.conf : server.modules += ( "mod_cgi" ) and in cgi.conf :

cgi.assign    = ( ".pl"  => "/usr/bin/perl",
                                        ".py"  => "/usr/bin/python" )

                      $HTTP["url"] =~ "^/cgi-bin" {
   cgi.assign = ( ".py" => "/usr/bin/python" )

and make sure that log file is owned by lighttpd process.

I am running this on CentOS 7.2

EDIT: When running from lighttpd, the user and group is not root but lighttpd. If I print the error from the executed command by using Popen instead of check_output, I got the error ping: socket: Operation not permitted

Seems like this is a permission error. So then how can I grant lighttpd root privileges?

Answer 1

This looks like a permission problem. If its possible to give your lighttpd process full access, go to \etc\sudoers and add the line lighttpd ALL=(ALL:ALL) NOPASSWD: ALL. This will grant the lighttpd user full access/privileges without prompting for a password. Let me know if it works.