I need to allow a particular user to run a specific python script. This user has access to a restricted bash which for now allows only the clear
command.
Usually, the script would be run through python3 script_name.py
. In this case, the goal is to restrict the users capabilities at the maximum. Thus, I would like to not give access to the python3
command to the user.
Is there a way to restrict the use of the python3
command to the specific python3 script_name.py
or a way to automatically and temporarily switch user to an authorized one, run the script, and then switch back to the original user?
Thanks a lot!
Edit:
While searching further information regarding the capabilities of the restricted shell and its configuration, I found this page, on which is said:
When a command that is found to be a shell script is executed (see Shell Scripts), rbash turns off any restrictions in the shell spawned to execute the script.
Does this mean that creating a .sh
file containing python3 script_name.py
in the base folder for the user and adding the execution rights to this file should solve my issue? It is after all a shell script and thus should be exempted from restrictions.
Update:
While a script didn't solve my issue, @muru pointed me to a functional workaround.
I created a "launcher.py" executable file in the user's commands location containing only the following:
#! /usr/bin/python3
import sys
sys.path.insert([1], <path_to_actual_script>)
import <actual_script>
This allows the user to run the launcher.py
command while not directly having access to the program.