Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have asked this question before but with not much success. I guess i was confused and did not put my question properly. So here it goes again.

Some points before i begin:

  1. I am running FC 14
  2. I did not install apache manually ... used yum
  3. safe mode in PHP is turned OFF

Basically I want to execute ping command and show the results on the PHP page. The code I use is

<?php
$who = shell_exec('whoami');
$result1 = shell_exec("/webserver_commands/ping -c 4 www.google.com");
exec("ping -c 4 www.google.com",$result2);

echo $who;
echo "<br/>".$result1;
echo "<br/>".$result2;
?>

The Output I get is

apache 

Array

So I know the scripts are being run as the user 'apache'

In the apache log I see the following lines

sh: /webserver_commands/ping: Permission denied
ping: icmp open socket: Permission denied

I have made sure the directory /webserver_commands/ and the file ping in it are owned by the user apache of the group apache

917506 drwxrwxrwx.   2 apache apache  4096 Feb  4 18:29 webserver_commands
917507 -rwxrwxrwx. 1 apache apache 43448 Feb  4 18:29 ping

Any ideas what could be going wrong here ?

thank you, -ankit

share|improve this question
2  
Remove the write permissions for "other" - it's a security risk and is unnecessary. chmod o-w ping –  Dennis Williamson Feb 5 '11 at 0:56

3 Answers 3

up vote 1 down vote accepted

apache user does not have sufficient rights to send ICMP packets, consider using Net_Ping library from PEAR instead. If you are using Debian it can be installed using apt-get install php-net-ping

share|improve this answer
    
Unfortunately i need to execute multiple such commands including "free" and most of them are giving this error. will look into net_ping though. thanks ! –  ankit Feb 5 '11 at 1:43
1  
You should disable SELinux in /etc/sysconfig/selinux and reboot then. Apparently the first sh: /webserver_commands/ping: Permission denied error is caused by SELinux, I don't see it on my Debian box. –  Alex Feb 5 '11 at 1:58
1  
while you are probably on the right track with selinux, disabling it entirely on a publicly accessible web server is a bad idea. –  Patrick Feb 5 '11 at 2:08
    
@patrick @alex You guys rule ! It was selinux after all. Disabled it temporarily and reloaded the page .. worked like a charm ! now just need to read up on what exactly selinux does and if i need it or not. –  ankit Feb 6 '11 at 2:59

if you want to display $result2 you need to implode it. exec() puts its output into the second argument as an array. So

print(implode("<br>",$result2));

Or echo, whatever your preference

As for ping, its not working because it lost the setuid bit when you copied it. You need to do

chown root /webserver_commands/ping
chmod u+s /webserver_commands/ping
share|improve this answer
    
tried what you suggested. Get exactly the same error. –  ankit Feb 5 '11 at 1:44
    
@ankit I didnt think of selinux (seeing another comment reminded me). The solution in the comment is to disable selinux completely, which is ill advised for a publicly accessible web server. I would see if someone else knows how to get selinux to allow /webserver_commands/ping to operate without disabling selinux completely. –  Patrick Feb 5 '11 at 2:07
    
In fact, I know how to alter a SELinux policy to allow these commands to operate, audit2allow and a number of other command line tools should be used as described here to create a binary policy alteration module and to install it. –  Alex Feb 5 '11 at 2:15
    
@alex Thanks guys. I will look into the link and report back –  ankit Feb 5 '11 at 4:48
    
@alex You guys rule ! It was selinux after all. Disabled it temporarily and reloaded the page .. worked like a charm ! now just need to read up on what exactly selinux does and if i need it or not. –  ankit Feb 6 '11 at 2:57

One potential cause is that ping is by design a root-only command so, in order to execute it from non-root users, many distributions have the setuid bit set on 'ping'; however, conversely, many do not - this may include FC14

If ping does not have the setuid bit set, and if you are willing to open up this potential (but unlikely) security hole you can chmod u+s on ping to allow it to be executed from any user.

share|improve this answer
    
No change. get the same error.I am however able to execute simple commands such as "cat" –  ankit Feb 5 '11 at 1:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.