Threading with Sudo with Context and Passing in Arguments

[nickbabcock]

Given a system with a user of 'nick' who is not in the sudoers file and the following code that is ran as root:

import sh
import threading
from time import sleep

def worker(username):
    with sh.sudo('-u', username, _with=True):
        sleep(5)
        print username, sh.id()

t1 = threading.Thread(target=worker, args=('nick',))
t2 = threading.Thread(target=worker, args=('root',))

t1.start()
sleep(1)
t2.start()

The expected output is:

nick uid=502(nick) gid=502(nick) groups=502(nick)
root uid=0(root) gid=0(root) groups=0(root)

The actual output is:

Exception in thread Thread-1:
Traceback (most recent call last):
  File "/usr/lib64/python2.6/threading.py", line 532, in __bootstrap_inner
    self.run()
  File "/usr/lib64/python2.6/threading.py", line 484, in run
    self.__target(*self.__args, **self.__kwargs)
  File "thr.py", line 8, in worker
    print username, sh.id()
  File "/home/nick/threading/lib/python2.6/site-packages/sh.py", line 769, in __call__
    return RunningCommand(cmd, call_args, stdin, stdout, stderr)
  File "/home/nick/threading/lib/python2.6/site-packages/sh.py", line 330, in __init__
    self.wait()
  File "/home/nick/threading/lib/python2.6/site-packages/sh.py", line 334, in wait
    self._handle_exit_code(self.process.wait())
  File "/home/nick/threading/lib/python2.6/site-packages/sh.py", line 348, in _handle_exit_code
    self.process.stderr
ErrorReturnCode_1:

  RAN: '/usr/bin/sudo -u nick /usr/bin/sudo -u nick /usr/bin/sudo -u root /usr/bin/id'

  STDOUT:


  STDERR:
nick is not in the sudoers file.  This incident will be reported.


nick root uid=502(nick) gid=502(nick) groups=502(nick)

EDIT: Looks like it is due to the static variable _prepend_stack being manipulated in the threads before they can properly execute.

[amoffat]

i think the only fix here is a documentation fix about thread safety. the only way to make with context's thread safe would be to introduce a handle on the context object:

import sh

with sh.sudo(_with=True) as h:
    print(h.ls("/root"))

you would need to prefix every command in the block with h....but this already exists in the form of subcommands:

from sh import sudo

print(sudo.ls("/root"))

in the interest of not removing functionality right now that people are using in non-threaded environments, i'm just going to deprecate

[noisygecko]

It would be good to remove the examples from the documentation then, if it is deprecated. http://amoffat.github.io/sh/

[vlovich]

Why not just use thread-local storage?

http://stackoverflow.com/questions/1408171/thread-local-storage-in-python

Everything stays the same from the API perspective & the with works as intended.

[vlovich]

It's may be worthwhile to ensure, if possible, that any new threads inherit the with from the thread they were spawned from. That way:

with sudo:
    t1 = sh.Thread(target=worker, args=('nick',))
    t2 = sh.Thread(target=worker, args=('root',))
    t1.start()
    t2.start()

works as expected & both threads run as sudo. You'd need to override Thread so that you could interject on the new thread & propogate the thread-local variable from the current thread.

[AGSaidi]

Using the sudo.ls() example above, is it possible to pass parameters to sudo?
For example, how would you replace:

    with sudo('-u foo', _with=True):
        ls()

[amoffat]

Added thread safety using @vlovich 's threadlocal idea. This is in the release-1.2 branch and will go out with it when it ships