Question

The objective of my application is to control some LEDs on my embedded target from the ethernet link. My embedded board supports lighttpd web server. From this web server, I can run python scripts that read to devices on my board no problem. The problem comes when I am trying to write to those devices. The lighttpd server is running as “www” group. My board’s root user has no password. Any attempt i make to force the lighttpd server to run as root results in lighttpd not starting at all. So I made a C program to be called as a subprocess elevated to root via sudo from the python script.

my C program that controls the LEDs:

int main(int argc, char* args[]){   
string python_message = "";
bool quit = false;

while (!quit)
{
    cin >> python_message;  
    if (python_message == "quit"){
    quit = true;
    }else if (python_message == "1"){
        ledn(1,"1");    
    }else if (python_message == "2"){
        ledn(1,"0");
    }else {
    cout << "Huh?" << endl;
    }   
}   
return 0;
}

The python script that is in cgi-bin

import sys
import time

print "Blinking User LED Program"

import subprocess
proc = subprocess.Popen(["sudo","/usr/bin/slave"], stdin=subprocess.PIPE, stdout=subprocess.PIPE)

print "1"
proc.stdin.write("1\n")
time.sleep(.5)
print "0"
proc.stdin.write("0\n")
time.sleep(.5)

If i comment the proc.stdin and proc.stdout lines my program runs and gives me all the print statement outputs.
When those lines are there i get a 500 server error.

Answer 1

Ricardo Cárdenes’s suggestion to change the ownership or permissions of the device is a good one, but if you can’t do that, just make the Python script that lighttpd calls be a “setuid” script, meaning that lighttpd will invoke it as www but it will run as root.

I normally would not suggest making a script setuid (making a compiled C program setuid is a little less dangerous, maybe). But in your case you don’t seem to be concerned about security (since you mentioned trying to run lighttpd as root), so I’d give it a shot. Just don’t forget that your setuid script can then do anything it wants!