Question

我试图通过Amazon Linux 2016.09 c4.xlarge模块在subprocess上运行一些命令。

我无法使用chef或其他CM tools，因为在运行脚本之前我不知道这些命令。我的脚本解析了从CIS安全工具输出的XML报告。

在一个实例中，在尝试以下语句后，我收到错误：

executing command  chown root:root /etc/cron.daily
executing command  iptables -P INPUT DROP
executing command  yum -y install aide

# then crashes: terminal freezez and instance is inaccessible over port 22

在另一次审判中，违规的yum电话是

executing command  chown root:root /etc/cron.daily
executing command  iptables -P INPUT DROP
executing command  yum -y remove xorg-x11*
Loaded plugins: priorities, update-motd, upgrade-helper
Resolving Dependencies
--> Running transaction check
---> Package xorg-x11-font-utils.x86_64 1:7.2-11.5.amzn1 will be erased
---> Package xorg-x11-fonts-Type1.noarch 0:7.2-9.1.5.amzn1 will be erased
--> Processing Dependency: xorg-x11-fonts-Type1 for package: 1:java-1.7.0-openjdk-1.7.0.131-2.6.9.0.71.amzn1.x86_64
--> Running transaction check
---> Package java-1.7.0-openjdk.x86_64 1:1.7.0.131-2.6.9.0.71.amzn1 will be erased
--> Finished Dependency Resolution

Dependencies Resolved
# then crashes: terminal freezez and instance is inaccessible over port 22

脚本本身是：

class CommandFix(object):

    def _execute_command(self):
        for command in self.commands:
            command = command.replace('#', '')
            command = command.replace('yum', 'yum -y')

            print("executing command", command)

            self.stdout_log.write("fixing {} : running command {}\n".format(
                self.rule_id,
                command))

            try:
                cp = subprocess.run(command,
                    shell=True, check=True
                    )
            except subprocess.CalledProcessError as e:
                self.stderr_log.write("error fixing {} : {}\n".format(
                    self.rule_id,
                    e))

                # TO-DO: Handle error with retry or similar
                # right now just return false
                return False

        return True

Answer 1

您可能需要关闭子流程。

尝试在代码中添加以下行 -

import os
process_execution_status = False
try:
    #your code
    process_execution_status = True
catch Exception as exc:
    #exc handling
    process_execution_status = False
finally:
    os.killpg(os.getpgid(cp.pid), signal.SIGTERM)
    return process_execution_status

Answer 2

问题在于iptables命令。它正在丢弃所有入站连接。实例很好，只是被iptables阻止了

Amazon Linux Instance使用subprocess.run在Python脚本中死亡

2 个答案: