I've setup my Raspberry Pi with nginx and fcgiwrap as CGI. I wanted to control GPIO ports using a Python script with the Rpi.GPIO library. The problem is that in order to be able to control the ports, I need to run python as root, therefore CGI as root.

I've read in this the question How to include RPi.GPIO in a python CGI script with lighttpd? that running a CGI server as root opens a big seccurity hole. Can you explain why?

Running a web server as root is considered unsafe because any security flaw in your web applications could potentially allow an attacker to execute code with root privileges.

If your web server is running with limited privileges, an attacker can gain, at most, the same privileges the web server has.

  • The web server is not running as root but it calls the CGI server which is running as root. Is this the same scenario? – Tomas Oct 16 '12 at 14:56
  • 1
    @Tomas: The gist of it is, user input should never be evaluated in a root context. Because that introduces the possibility of malicious code being executed in that context. – Der Hochstapler Oct 16 '12 at 15:56
  • An attacker may gain further privileges even with a limited web server, but they'll have to break something else as well. E.g. use a httpd bug to gain access to one host and then find bad permissions, sniff trusted internal network traffic or plant trojans to gain root or access to another computer etc. People who think security is a product or a perimeter typically have other mistakes in their network and there will always be bugs so you can't place complete faith in limited privileges either. – XTL Oct 19 '12 at 12:04

You can change the ownership of the required GPIO device files to a non-root userid under which you run the web server and associated helpers. Even better, assign them to a user group including both the web server and your test account, and set the group permission bits.

Or you can write a daemon which runs as a user which has been granted access to those files, and accepts commands and queries which it carefully sanitizes over a channel such as a unix domain socket, named pipe with file-level access restrictions, etc.

  • Recent version of python GPIO module (as of version 0.3.0) uses memory mapped GPIO registers by /dev/mem (instead of /sys/class/gpio). One could chage ownership of /dev/mem but this would not be really much more secure from running as root. Your second suggestion is much better but it involves much more work. – Krzysztof Adamski Oct 16 '12 at 16:54
  • Or one could revert to the old method of doing GPIO... – Chris Stratton Oct 16 '12 at 19:19

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.