Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've just finished setting up supervisor to run my gunicorn instances and I was wondering if there is a default way to let a regular user run supervisorctl to start/stop the websites. I was thinking of adding some sudo config that would enable this user to run it but then I think it might open some loophole through which an intruder could run stuff as root. I know I can set user=someuser on the [supervisord] config section, but then I'd have to give permission to that user for files all over the filesystem, for logs, socket creation, etc. That would be a problem because the standard ubuntu package deploy assumes supervisor will be run as root.

So which one is better, or is there another alternative?

share|improve this question

2 Answers 2

sudo is really the better alternative here. If you are afraid that they can pass arguments to supervisorctl other than start/stop, maybe create two small binaries (not scripts!) that do nothing other than call supervisorctl start/stop (and not using system(3) but exec(3)) and only enable calling those two specific binaries for the user.

share|improve this answer
    
Surely a script will do. Just make sure that the user(s) in question can't write to the script ? –  Iain Jul 4 '11 at 20:04
    
The problem with scripts is that they are insecure. Maybe not for such a simple script, but in time it will be modified. Because of this, I discourage their use. –  ptman Jul 5 '11 at 1:28

Deploy your websites in a buildout, build supervisor inside of it, and then bin/supervisorctl start/stop will be the user id, all the config will be in the buildout, and it will not require root.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.