python模拟app请求_选择性地请求root用户访问一段（打包的）python .app

This problem involves the collision of several problems, all of which I understand only somewhat well, but I include them together because they could all be the entry point for a solution. Here is the best description I can give.

I have an app, in python. (I imagine I could theoretically solve all of these problems by learning Cocoa and ObjectiveC, but that seems like QUITE a lift, for this problem -- AND, as noted below, this problem may not actually be related to python, really, at all. I just don't know.) A CORE feature of this app is to trigger a minigame, with a hotkey -- meaning, the hotkey itself is fundamental to the desired functionality. And furthermore, I would really like to package this app, to let other people use it. (Locally, it works great! Hey!)

The problem starts with the fact that adding the hotkey -- which I am doing with

import keyboard

keyboard.add_hotkey('windows+shift+y', trigger_minigame)

-- requires root access. Due to DIRE WARNINGS in another SO post Forcing a GUI application to run as root (which, honestly, I only vaguely understand), I would like to grant that access to ONLY this part of the program. I IMAGINE, such an approach would look something like this:

# needs_root.py

import keyboard

from shouldnt_have_root import trigger_minigame

keyboard.add_hotkey('windows+shift+y', trigger_minigame)

# shouldnt_have_root.py

def minigame():

buncha pygame, GUI stuff (which is dangerous???)

def trigger_minigame():

adds event to minigame's event queue

# bash script

sudo python needs_root.py

HOWEVER -- there are several major challenges!

The biggest is that I don't even know if THAT is safe, since I don't know how security and permissions (especially with imports) works at all! And more generally, how dangerous are the imports? It appears that I may in fact have to import substantially more, to make it clear what event queue the trigger is adding an event TO -- and I don't know how to have that communication happen, while still isolating the GUI parts (or generally dangerous ones) from unnecessary and hazardous access.

There's another layer too though; packaging it through pyinstaller means that I can't target the scripts directly, because they'll have been turned into binaries, but according to THIS answer Packaging multiple scripts in PyInstaller it appears I can just target the binaries instead, i.e. have the first binary call

osascript -e 'do shell script "python needs_root_binary" with admin.'

to get the user to bless only the necessary part, but I don't know if that will put OTHER obstacles, or vulnerabilities (or inter-file communication difficulties), in the way.

LAST, I could try STARTING as root, and then switching away from it, as soon as the hotkey is set (and before anything else happens) -- but would that be safe? I'm still worried about the fact that it involves running sudo on the whole app.

In any event --

is this as big a mess as it feels?

How do I give root access to only a piece of a packaged .app, that I've written in python?

解决方案

I'd advice You to:

enable the root access,

write the script,

disable the root access

as it's closer described in here.

The Pyinstaller is another chapter. When I was making software requiring usage of hotkeys, I was forced to use another than keyboard, because it wasn't working properly on PC without Python, therefore I made a hotkey with tkinter built-in function canvas.bind() (more info here).

Hopefully I helped.