[ norboten ]
python · lab python-02

The Tool Only Root Can Run

· about 35 minutes · runs on ubuntu-26.04-devops · unrated

An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.

The briefing

netprobe is the team's small connectivity checker. It reads a list of host:port targets and says which ones accept connections:

$ netprobe check --config /etc/netprobe/targets.yaml
[{"target": "127.0.0.1:22", "open": true}, ...]

A colleague installed version 1.4.0 on this machine before leaving on holiday, into the virtual environment /opt/netprobe/venv, from the checkout in their working copy. It works for them as root. Everyone else gets command not found, and when they call the venv's program by its full path they get Permission denied or ModuleNotFoundError.

What is expected, and graded — the grader runs netprobe as your own, unprivileged account:

  1. netprobe --version works for every user, from the normal PATH, and prints netprobe 1.4.0.
  2. netprobe check --config /etc/netprobe/targets.yaml works for every user and reports that 127.0.0.1:22 is open.
  3. The installed tool is a self-contained copy in /opt/netprobe/venv: it keeps working if the working copy it was installed from is deleted or changes.

Nothing can be downloaded: the machine has no internet access. The wheels the project needs are in /opt/wheels. You have root through sudo. Everything must still hold after a reboot.

What is graded

The machine is checked, rebooted, and checked again. A check passes only if it passes both times.

CheckObjective
01_every_user_can_run_itInstall a Python application into its own virtual environment for every user of the machine
02_checks_targets_as_a_userInstall a Python application into its own virtual environment for every user of the machine
03_installed_copy_stands_aloneTell an editable development install from a real one, and know what each depends on

Start it

  1. 2Labs
  2. python-02select this one
  3. udownload it
  4. sstart the machine

Reading

Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).

Theory for this lab

4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:

Question 1

What does this print?

import subprocess, sys, tempfile, os
venv = os.path.join(tempfile.mkdtemp(), "v")
subprocess.run([sys.executable, "-m", "venv", "--without-pip", venv], check=True)
out = subprocess.run([f"{venv}/bin/python", "-c", "import sys; print(sys.prefix == sys.base_prefix)"],
                     capture_output=True, text=True).stdout.strip()
print(out, os.path.exists(f"{venv}/pyvenv.cfg"))
Question 2

What does this print?

import os, subprocess, sys, tempfile
site = tempfile.mkdtemp(); src = tempfile.mkdtemp()
os.makedirs(f"{src}/pkgdemo"); open(f"{src}/pkgdemo/__init__.py", "w").close()
open(f"{site}/demo.pth", "w").write(src + "\n")
code = f"import site; site.addsitedir({site!r}); import pkgdemo; print(pkgdemo.__file__.startswith({src!r}))"
print(subprocess.run([sys.executable, "-c", code], capture_output=True, text=True).stdout.strip())
Question 3

An ordinary user runs /opt/tool/venv/bin/tool and gets exit status 126, "Permission denied". The file is mode 755. What is the most likely cause?