Question

I have a process running as root that needs to spin threads off to be run as various users. This part is working fine, but I need a way to communicate between the child processes and the parent process.

When I try using multiprocessing.Manager() with some lists, dictionary, Lock, Queue, etc, it always has permission denied errors on the process that has lowered permissions.

Is there a way to grant access to a user or PID to fix this?

Basic code that represents what I’m running into (run as root):

#!/usr/bin/env python
import multiprocessing, os
manager = multiprocessing.Manager()
problematic_list = manager.list()
os.setuid(43121) # or whatever your user is
problematic_list.append('anything')

Result:

root@liberator:/home/bscable# python asd.py
Traceback (most recent call last):
  File "asd.py", line 8, in <module>
    problematic_list.append('anything')
  File "<string>", line 2, in append
  File "/usr/lib/python2.7/multiprocessing/managers.py", line 755, in _callmethod
    self._connect()
  File "/usr/lib/python2.7/multiprocessing/managers.py", line 742, in _connect
    conn = self._Client(self._token.address, authkey=self._authkey)
  File "/usr/lib/python2.7/multiprocessing/connection.py", line 169, in Client
    c = SocketClient(address)
  File "/usr/lib/python2.7/multiprocessing/connection.py", line 293, in SocketClient
    s.connect(address)
  File "/usr/lib/python2.7/socket.py", line 224, in meth
    return getattr(self._sock,name)(*args)
socket.error: [Errno 13] Permission denied
Traceback (most recent call last):
  File "/usr/lib/python2.7/multiprocessing/util.py", line 261, in _run_finalizers
    finalizer()
  File "/usr/lib/python2.7/multiprocessing/util.py", line 200, in __call__
    res = self._callback(*self._args, **self._kwargs)
  File "/usr/lib/python2.7/multiprocessing/managers.py", line 625, in _finalize_manager
    process.terminate()
  File "/usr/lib/python2.7/multiprocessing/process.py", line 137, in terminate
    self._popen.terminate()
  File "/usr/lib/python2.7/multiprocessing/forking.py", line 165, in terminate
    os.kill(self.pid, signal.SIGTERM)
OSError: [Errno 1] Operation not permitted

The first exception appears to be the one that is important here.

Answer 1

Python (at least 2.6) uses a UNIX socket to communicate that appears like so:

/tmp/pymp-eGnU6a/listener-BTHJ0E

We can grab that path and change the permissions on it like so:

#!/usr/bin/env python
import multiprocessing, os, grp, pwd
manager = multiprocessing.Manager()
problematic_list = manager.list()

fullname = manager._address
dirname = os.path.dirname(fullname)

gid = grp.getgrnam('some_group').gr_gid
uid = pwd.getpwnam('root').pw_uid # should always be 0, but you never know

os.chown(dirname, uid, gid)
os.chmod(dirname, 0770)

os.chown(fullname, uid, gid)
os.chmod(fullname, 0770)

os.setgid(gid)
os.setuid(43121) # or whatever your user is
problematic_list.append('anything')

---