uWSGI中设置“cap = setuid,setpid”导致python脚本权限降低

发表于 | 分类于 |

问题发现

背景

  • uwsgi version： 2.0.13.1
  • python version: 2.6.6
  • 采用 Nginx + uWSGI + Python 架构，均拥有ROOT权限

现象

Python执行os.mkdir操作，提示“Permission Denied”

1
2
3
4
5
6
7
8
9
10
11
12
13
14
Traceback (most recent call last):
File "/cs/nginx/uwsgi/main.py", line 24, in application
result = process().entry(environ, start_response)
File "/cs/nginx/uwsgi/rds/base_mng.py", line 90, in entry
self.process_put_request(env)
File "/cs/nginx/uwsgi/rds/init_rds.py", line 149, in process_put_request
result = self.do_put_request(env)
File "/cs/nginx/uwsgi/rds/init_rds.py", line 140, in do_put_request
err_code = op.do()
File "/cs/nginx/uwsgi/rds/init_rds.py", line 70, in do
if 0 == init_create_mp(mp):
File "/cs/nginx/uwsgi/rds/init/main.py", line 44, in init_create_mp
os.mkdir(mp,0755)
OSError: [Errno 13] Permission denied: '/aaab'

解决

Python脚本的权限，有uWSGI来决定，所以该错误肯定跟uWSGI有关，通过调整uwsgi.ini文件中的用户和权限相关配置发现，将cap = setuid,setgid去掉，可以正常创建目录。

但：具体原因不明，可能跟setuid和setgid的使用有关，有可能是个Bug