zhangyiss/the-littlest-jupyterhub
1
0
Fork 0
mirror of https://github.com/jupyterhub/the-littlest-jupyterhub.git synced 2025-12-18 21:54:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

Preserve PATH when using sudo -E

Browse Source 
jupyterhub admins should be able to run `sudo -E pip install numpy`
and install numpy into the user environment. However, since pip
is in the PATH we explicitly set in jupyterhub_config.py and
sudo doesn't preserve PATH, this won't work.

We exempt jupyterhub-admins groups from the PATH restriction,
so sudo -E works. This has some security costs, but we are already
allowing passwordless roots for them with unrestricted paths...
This commit is contained in:
yuvipanda
2018-06-28 01:22:27 -07:00
parent dd53176889
commit 3f0c8942cc
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
tljh/installer.py
View File

@@ -73,7 +73,12 @@ user.ensure_group('jupyterhub-admins')
user.ensure_group('jupyterhub-users')
with open('/etc/sudoers.d/jupyterhub-admins', 'w') as f:
f.write('%jupyterhub-admins ALL = (ALL) NOPASSWD: ALL')
# JupyterHub admins should have full passwordless sudo access
f.write('%jupyterhub-admins ALL = (ALL) NOPASSWD: ALL\n')
# `sudo -E` should preserve the $PATH we set. This allows
# admins in jupyter terminals to do `sudo -E pip install <package>`,
# `pip` is in the $PATH we set in jupyterhub_config.py to include the user conda env.
f.write('Defaults exempt_group = jupyterhub-admins')
conda.ensure_conda_env(USER_ENV_PREFIX)
conda.ensure_conda_packages(USER_ENV_PREFIX, [