Django and root processes

问题:

In my Django project I need to be able to check whether a host on the LAN is up using an ICMP ping. I found this SO question which answers how to ping something in Python and this SO question which links to resources explaining how to use the sodoers file.

The Setting

A Device model stores an IP address for a host on the LAN, and after adding a new Device instance to the DB (via a custom view, not the admin) I envisage checking to see if the device responds to a ping using an AJAX call to an API which exposes the capability.

The Problem

However (from the docstring of a library suggested in the the first SO question) "Note that ICMP messages can only be sent from processes running as root."

I don't want to run Django as the root user, since it is bad practice. However this part of the process (sending and ICMP ping) needs to run as root. If with a Django view I wish to send off a ping packet to test the liveness of a host then Django itself is required to be running as root since that is the process which would be invoking the ping.

Solutions

These are the solutions I can think of, and my question is are there any better ways to only execute select parts of a Django project as root, other than these:

1. Run Django as root (please no!)
2. Put a "ping request" in a queue that another processes -- run as root -- can periodically check and fulfil. Maybe something like celery.

Is there not a simpler way?

I want something like a "Django run as root" library, is this possible?

回答1:

Absolutely no way, do not run the Django code as root!

I would run a daemon as root (written in Python, why not) and then IPC between the Django instance and your daemon. As long as you're sure to validate the content and properly handle it (e.g. use subprocess.call with an array etc) and only pass in data (not commands to execute) it should be fine.

Here is an example client and server, using web.py

Server: http://gist.github.com/788639 Client: http://gist.github.com/788658

You'll need to install webpy.org but it's worth having around anyway. If you can hard-wire the IP (or hostname) into the server and remove the argument, all the better.

回答2:

What's your OS here? You might be able to write a little program that does what you want given a parameter, and stick that in the sudoers file, and give your django user permission to run it as root.

/etc/sudoers

回答3:

I don't know what kind of system you're on, but on any box I've encountered, one does not have to be root to run the command-line ping program (it has the suid bit set, so it becomes root as necessary). So you could just invoke that. It's a bit more overhead, but probably negligible compared to network latency.