parameters: (uid='nobody', gid='nogroup', supl_groups=None)
docstring: Drop privileges by changing the current process owner/group to
      *uid*/*gid* (both may be an integer or a string).  If *supl_groups* (list)
      is given the process will be assigned those values as its effective
      supplemental groups.  If *supl_groups* is None it will default to using
      'tty' as the only supplemental group.  Example::
  
          drop_privileges('gateone', 'gateone', ['tty'])
  
      This would change the current process owner to gateone/gateone with 'tty' as
      its only supplemental group.
  
      .. note::
  
          On most Unix systems users must belong to the 'tty' group to create new
          controlling TTYs which is necessary for 'pty.fork()' to work.
  
      .. tip::
  
          If you get errors like, "OSError: out of pty devices" it likely means
          that your OS uses something other than 'tty' as the group owner of the
          devpts filesystem.  'mount | grep pts' will tell you the owner (look for
          gid=<owner>).
docstring_summary: Drop privileges by changing the current process owner/group to
      *uid*/*gid* (both may be an integer or a string).  If *supl_groups* (list)
      is given the process will be assigned those values as its effective
      supplemental groups.  If *supl_groups* is None it will default to using
      'tty' as the only supplemental group.  Example::
docstring_tokens: Drop privileges by changing the current process owner / group to * uid * / * gid * ( both may be an integer or a string ) . If * supl_groups * ( list ) is given the process will be assigned those values as its effective supplemental groups . If * supl_groups * is None it will default to using tty as the only supplemental group . Example ::
function: def drop_privileges(uid='nobody', gid='nogroup', supl_groups=None):
      """
      Drop privileges by changing the current process owner/group to
      *uid*/*gid* (both may be an integer or a string).  If *supl_groups* (list)
      is given the process will be assigned those values as its effective
      supplemental groups.  If *supl_groups* is None it will default to using
      'tty' as the only supplemental group.  Example::
  
          drop_privileges('gateone', 'gateone', ['tty'])
  
      This would change the current process owner to gateone/gateone with 'tty' as
      its only supplemental group.
  
      .. note::
  
          On most Unix systems users must belong to the 'tty' group to create new
          controlling TTYs which is necessary for 'pty.fork()' to work.
  
      .. tip::
  
          If you get errors like, "OSError: out of pty devices" it likely means
          that your OS uses something other than 'tty' as the group owner of the
          devpts filesystem.  'mount | grep pts' will tell you the owner (look for
          gid=<owner>).
      """
      import pwd, grp
      human_supl_groups = []
      running_uid = uid
      running_gid = gid
      if not isinstance(uid, int):
          # Get the uid/gid from the name
          running_uid = pwd.getpwnam(uid).pw_uid
      if not isinstance(gid, int):
          running_gid = grp.getgrnam(gid).gr_gid
      if supl_groups:
          for i, group in enumerate(list(supl_groups)):
              # Just update in-place
              if not isinstance(group, int):
                  supl_groups[i] = grp.getgrnam(group).gr_gid
              human_supl_groups.append(grp.getgrgid(supl_groups[i]).gr_name)
          try:
              os.setgroups(supl_groups)
          except OSError as e:
              logging.error(_('Could not set supplemental groups: %s' % e))
              exit()
      # Try setting the new uid/gid
      try:
          os.setgid(running_gid)
      except OSError as e:
          logging.error(_('Could not set effective group id: %s' % e))
          exit()
      try:
          os.setuid(running_uid)
      except OSError as e:
          logging.error(_('Could not set effective user id: %s' % e))
          exit()
      # Ensure a very convervative umask
      new_umask = 0o77
      os.umask(new_umask)
      # Fix some basic/known environment variables
      pwd_obj = pwd.getpwuid(running_uid)
      os.environ['USER'] = pwd_obj.pw_name
      os.environ['LOGNAME'] = pwd_obj.pw_name
      os.environ['HOME'] = pwd_obj.pw_dir
      os.environ['SHELL'] = pwd_obj.pw_shell
      final_gid = os.getgid()
      logging.info(_(
          'Running as user/group, "%s/%s" with the following supplemental groups:'
          ' %s' % (pwd_obj.pw_name, grp.getgrgid(final_gid)[0],
                   ",".join(human_supl_groups))
      ))
function_tokens: def drop_privileges ( uid = 'nobody' , gid = 'nogroup' , supl_groups = None ) : import pwd , grp human_supl_groups = [ ] running_uid = uid running_gid = gid if not isinstance ( uid , int ) : # Get the uid/gid from the name running_uid = pwd . getpwnam ( uid ) . pw_uid if not isinstance ( gid , int ) : running_gid = grp . getgrnam ( gid ) . gr_gid if supl_groups : for i , group in enumerate ( list ( supl_groups ) ) : # Just update in-place if not isinstance ( group , int ) : supl_groups [ i ] = grp . getgrnam ( group ) . gr_gid human_supl_groups . append ( grp . getgrgid ( supl_groups [ i ] ) . gr_name ) try : os . setgroups ( supl_groups ) except OSError as e : logging . error ( _ ( 'Could not set supplemental groups: %s' % e ) ) exit ( ) # Try setting the new uid/gid try : os . setgid ( running_gid ) except OSError as e : logging . error ( _ ( 'Could not set effective group id: %s' % e ) ) exit ( ) try : os . setuid ( running_uid ) except OSError as e : logging . error ( _ ( 'Could not set effective user id: %s' % e ) ) exit ( ) # Ensure a very convervative umask new_umask = 0o77 os . umask ( new_umask ) # Fix some basic/known environment variables pwd_obj = pwd . getpwuid ( running_uid ) os . environ [ 'USER' ] = pwd_obj . pw_name os . environ [ 'LOGNAME' ] = pwd_obj . pw_name os . environ [ 'HOME' ] = pwd_obj . pw_dir os . environ [ 'SHELL' ] = pwd_obj . pw_shell final_gid = os . getgid ( ) logging . info ( _ ( 'Running as user/group, "%s/%s" with the following supplemental groups:' ' %s' % ( pwd_obj . pw_name , grp . getgrgid ( final_gid ) [ 0 ] , "," . join ( human_supl_groups ) ) ) )