Allows to use a directory with restricted access for the datasets

beat/backend/python/scripts/databases_provider.py

@@ -51,6 +51,7 @@ import logging
 import os
 import sys
 import docopt
+import simplejson
 
 import zmq
 
@@ -104,6 +105,7 @@ def main():
   args = docopt.docopt(__doc__ % dict(prog=prog, version=version),
           version=version)
 
+
   # Sets up the logging system
   if args['--debug']:
     logging.basicConfig(format='[remote|%(name)s] %(levelname)s: %(message)s',
@@ -114,6 +116,44 @@ def main():
 
   logger = logging.getLogger(__name__)
 
+
+  # If necessary, change to another user (with less privileges, but has access
+  # to the databases)
+  with open(os.path.join(args['<dir>'], 'configuration.json'), 'r') as f:
+    cfg = simplejson.load(f)
+
+  if cfg.has_key('datasets_uid'):
+    # First create the user (if it doesn't exists)
+    try:
+      user = pwd.getpwuid(cfg['datasets_uid'])
+    except:
+      import subprocess
+      retcode = subprocess.call(['adduser', '--uid', str(cfg['datasets_uid']),
+                                 '--no-create-home', '--disabled-password',
+                                 '--disabled-login', '--gecos', '""', '-q',
+                                 'beat-nobody'])
+      if retcode != 0:
+        send_error(logger, socket, 'sys', 'Failed to create an user with the UID %s' % args['uid'])
+        return 1
+
+    # Next, ensure that the needed files are readable by this user
+    access = stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR | stat.S_IRGRP | stat.S_IXGRP | stat.S_IROTH | stat.S_IXOTH
+    os.chmod(args['<dir>'], access)
+    for root, dirs, files in os.walk(args['<dir>']):
+      for d in dirs:
+        os.chmod(os.path.join(root, d), access)
+      for f in files:
+        os.chmod(os.path.join(root, f), access)
+
+    # Change the current user
+    try:
+      os.setuid(cfg['datasets_uid'])
+    except:
+      import traceback
+      send_error(logger, socket, 'sys', traceback.format_exc())
+      return 1
+
+
   # Creates the 0MQ socket for communication with BEAT
   context = zmq.Context()
   socket = context.socket(zmq.PAIR)
@@ -121,6 +161,7 @@ def main():
   socket.connect(address)
   logger.debug("zmq client connected to `%s'", address)
 
+
   try:
 
     # Check the dir
@@ -188,5 +229,6 @@ def main():
   return 0
 
 
+
 if __name__ == '__main__':
   sys.exit(main())