6

I've setup my Raspberry Pi with nginx and fcgiwrap as CGI. I wanted to control GPIO ports using a Python script with the Rpi.GPIO library. The problem is that in order to be able to control the ports, I need to run python as root, therefore CGI as root.

I've read in this the question How to include RPi.GPIO in a python CGI script with lighttpd? that running a CGI server as root opens a big seccurity hole. Can you explain why?

Improve this question

2 Answers 2

Reset to default
4

Running a web server as root is considered unsafe because any security flaw in your web applications could potentially allow an attacker to execute code with root privileges.

If your web server is running with limited privileges, an attacker can gain, at most, the same privileges the web server has.

Improve this answer
3
  • The web server is not running as root but it calls the CGI server which is running as root. Is this the same scenario?
    – Tomas
    Oct 16, 2012 at 14:56
  • 1
    @Tomas: The gist of it is, user input should never be evaluated in a root context. Because that introduces the possibility of malicious code being executed in that context.
    – Oliver Salzburg
    Oct 16, 2012 at 15:56
  • An attacker may gain further privileges even with a limited web server, but they'll have to break something else as well. E.g. use a httpd bug to gain access to one host and then find bad permissions, sniff trusted internal network traffic or plant trojans to gain root or access to another computer etc. People who think security is a product or a perimeter typically have other mistakes in their network and there will always be bugs so you can't place complete faith in limited privileges either.
    – XTL
    Oct 19, 2012 at 12:04
3

You can change the ownership of the required GPIO device files to a non-root userid under which you run the web server and associated helpers. Even better, assign them to a user group including both the web server and your test account, and set the group permission bits.

Or you can write a daemon which runs as a user which has been granted access to those files, and accepts commands and queries which it carefully sanitizes over a channel such as a unix domain socket, named pipe with file-level access restrictions, etc.

Improve this answer
2
  • Recent version of python GPIO module (as of version 0.3.0) uses memory mapped GPIO registers by /dev/mem (instead of /sys/class/gpio). One could chage ownership of /dev/mem but this would not be really much more secure from running as root. Your second suggestion is much better but it involves much more work.
    – Krzysztof Adamski
    Oct 16, 2012 at 16:54
  • Or one could revert to the old method of doing GPIO...
    – Chris Stratton
    Oct 16, 2012 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.