Repository navigation
Documentation for subprocess.Popen()'s "user", "group", "extra_groups" args may need more usage info #94632
Description
It's very easy for someone that doesn't really understand the details of how to drop privileges (e.g. me) to use the "user", "group", and "extra_groups" args to subprocess.Popen() incorrectly ... or at least not in a way that gets the results they expect. Since there are potentially many reasonable patterns for using these It might be at least worth documenting that just setting "user" isn't a replacement for running a command under su or runuser.
Linked PRs
- gh-94632: document the subprocess need for extra_groups=() with user= #148129
- [3.14] gh-94632: document the subprocess need for extra_groups=() with user= (GH-148129) #148130
- [3.13] gh-94632: document the subprocess need for extra_groups=() with user= (GH-148129) #148131
- [3.12] gh-94632: document the subprocess need for extra_groups=() with user= (GH-148129) #148132
- [3.10] gh-94632: document the subprocess need for extra_groups=() with user= (GH-148129) #148134
- [3.11] gh-94632: document the subprocess need for extra_groups=() with user= (GH-148129) #148133
Activity
pythongh-94632: document the subprocess need for extra_groups=() with…
Merge branch 'main' into pythongh-94632-docs-subprocess-user-groups
gh-94632: document the subprocess need for extra_groups=() with user= (…
pythongh-94632: document the subprocess need for extra_groups=() with…
pythongh-94632: document the subprocess need for extra_groups=() with…
pythongh-94632: document the subprocess need for extra_groups=() with…
pythongh-94632: document the subprocess need for extra_groups=() with…
pythongh-94632: document the subprocess need for extra_groups=() with…
gpshead commentedon Apr 5, 2026
Leaving this open as my PR only addressed one caveat, there's still a lot of room to make documenting this better.
The current state of things is that these were added and documented as making particular POSIX system calls. But that doesn't really do a good job of explaining what happens to users who are not intimately familiar with those semantics.
[3.14] gh-94632: document the subprocess need for extra_groups=() wit…
[3.13] gh-94632: document the subprocess need for extra_groups=() wit…
[3.10] gh-94632: document the subprocess need for extra_groups=() wit…
[3.11] gh-94632: document the subprocess need for extra_groups=() wit…
pythongh-94632: document the subprocess need for extra_groups=() with…
[3.12] gh-94632: document the subprocess need for extra_groups=() wit…