The problem
Previously, I wrote about using named pipes for IPC to
allow controlling a process by another process running on the same
computer possibly as a different user, with the access control set
by file permissions. But I observed that the restricted unidirectional
communication mechanism limited how useful it could be, suggesting
another design might be better in settings where bidirectional communication
including confirmation of commands may be useful.
Is there a good general solution to this problem without losing the
convenience of access control via file permissions?
The solution
Let's use everyone's favorite RPC mechanism: HTTP. But
HTTP normally runs over TCP, and even if we bind to
localhost, the HTTP server would still be accessible to
any user on the same computer and require selecting a port number that's
not already in use. Instead, we can bind the HTTP server to a
Unix socket, which similar to named pipes, look a lot like
a file, but allow communication like a network socket.
Python's built-in HTTP server doesn't directly support binding to a Unix
socket, but the following is slightly modified from
an example I found of how to get it to:
import http.server
import json
import os
import socket
import sys
import traceback
def process_cmd(cmd, *args):
print(f"In process_cmd({cmd}, {args})...")
class HTTPHandler(http.server.BaseHTTPRequestHandler):
def do_POST(self):
size = int(self.headers.get('Content-Length', 0))
body = self.rfile.read(size)
args = json.loads(body) if body else []
try:
result = process_cmd(self.path[1:], *args)
self.send(200, result or 'Success')
except Exception:
self.send(500, str(traceback.format_exc()))
def do_GET(self):
self.do_POST()
def send(self, code, reply):
# avoid exception in server.py address_string()
self.client_address = ('',)
self.send_response(code)
self.end_headers()
self.wfile.write(reply.encode('utf-8'))
sock_file = sys.argv[1]
try:
os.remove(sock_file)
except OSError:
pass
sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
sock.bind(sock_file)
sock.listen(0)
server = http.server.HTTPServer(sock_file, HTTPHandler,
False)
server.socket = sock
server.serve_forever()
sock.shutdown(socket.SHUT_RDWR)
sock.close()
os.remove(sock_file)
Then you can query the server using curl:
$ ./server.py http.socket &
$ curl --unix-socket http.socket http://anyhostname/foo
[GET response...]
$ curl --unix-socket http.socket http://anyhostname/foo \
--json '["some", "args"]'
[POST reponse...]
or in Python, using requests-unixsocket:
import requests_unixsocket
session = requests_unixsocket.Session()
host = "http+unix//http.socket/"
r = session.get(host + "foo")
# Inspect r.status_code and r.text or r.json()
r = session.post(host + "foo", json=["some", "args"])
# Inspect r.status_code and r.text or r.json()
The details