Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was building an app on a SUSE box, and had a binary called create_group for instance, which had a suid bit and allowed my PHP app to call exec('create_group grpname'); and create a new group (there are others for users, etc).

The binary was a small c script that calls setuid(0) and then runs the user creation stuff. This worked perfectly on the SUSE box

I recently moved my project to Ubuntu and everything works fine except these binaries. I can run them from the shell and they work okay, but when I get the PHP app to run them it just does nothing. Is there anything Ubuntu would be doing differently that I'm missing?

UPDATE: I've tried running one of my binaries called create_group which is essentially a groupadd wrapper, works fine from command line. When I run it in PHP and then check the apache errors logs, I have the following message:

sh: groupadd: not found

Any ideas on why this would be?

share|improve this question
    
Maybe check ownership as well and set owner to nobody. Not sure, but worth a try. –  jmort253 Jan 14 '11 at 4:16
    
Is PHP "safe mode" on? –  mattdm Jan 14 '11 at 4:17
    
And, safe mode or not, make sure to validate your input very, very carefully when you're doing this kind of thing! (I'd hope this goes without saying, but....) –  mattdm Jan 14 '11 at 4:18
    
aha yes, I will - I'll also check safe mode –  Lowgain Jan 14 '11 at 4:20
    
safe mode is not on –  Lowgain Jan 16 '11 at 1:57

3 Answers 3

It might be PHP safe_mode or it might be selinux. Newer distributions have SELinux enabled which propably would interfere.

Check out sudo. It's great for these kinds of tasks.

If everything else fails write a cron entry or daemon which creates new groups.

share|improve this answer

safe_mode, selinux (see dmesg for audit logs) or (perhaps more likely) safe_mode_exec_dir if your scripts are outside the default PHP path.

You might also want to add debugging (even something as simple as using logger to feed into syslog) to the scripts to make it more obvious where a problem is occurring.

share|improve this answer

Ubuntu (server) uses AppArmor to limit some things. This may be what is causing you problems: processes started from the http server (from php) may have less rights than normal processes. It will be logged when this happens. Check AppArmor docs on how to enable your specific application without opening things completely.

share|improve this answer
    
so would I need to change AppArmor settings for Apache, or of each of the binaries I've created? –  Lowgain Jan 16 '11 at 1:43
    
hmm, I tried turning it off completely and it still didn't work –  Lowgain Jan 16 '11 at 1:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.