Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working on a web interface (access only through intranet and not through internet). On clicking a button in the PHP page, a Python script does a few things and in the end, it needs to execute cp command as root.

I searched through different solutions and decided to adopt the one which suggested to give password-less sudo access to the apache user just for the /bin/cp command. So, I edited the sudoers file to give sudo access to apache without a password just for cp command and it worked fine. But, the next day I found that the line which I added was itself missing. I am not sure if some regular update takes place which overwrites the sudoers file.

Please help me figure out a possible solution to this problem.

share|improve this question

migrated from stackoverflow.com Jun 20 '11 at 17:00

This question came from our site for professional and enthusiast programmers.

    
@mdpc: I edited the sudoers only through the visudo utility and after my changes were made, I checked using the visudo -c option to see if it is parsing correctly. It gave a parsing ok message. @Michael: Thanks for your suggestion. I shall try to investigate in that angle. @Zhehao: cp should be executed as root since the destination directory is a windows network share mounted on a linux machine. If am not wrong, I think cp requires root privileges to be able to copy into that directory. –  user85127 Jun 20 '11 at 19:35
    
You should be aware that creating a sudo entry like that creates a BIG security hole in the system. –  cstamas Jun 20 '11 at 20:21
add comment

3 Answers

There isn't an automated process that does that on any distro I know.

To debug this, you should do several things: first, check the last modified time. (ls -l /etc/sudoers) A big pointer for it being an automated process is it happening right on the hour, such as at 0200h. You can check the cron files (/etc/crontab, /etc/cron.d/*, /etc/cron.{hourly,daily,monthly,weekly}) for anything that doesn't look normal (or everything), looking for anything that parses and/or writes to /etc/sudoers. And last, you can check root's ~/.bash_history or ask coworkers about it: maybe one of them restored from backup or accidentally overwrote your changes.

share|improve this answer
add comment

Why exactly does the cp command have to be executed as root? Couldn't you adjust the ownership and permissions of the directories you're copying from/to so that the apache user can perform a copy without root permissions?

share|improve this answer
    
+1, not really an answer so much as a question though –  Ziplin Jun 20 '11 at 19:37
    
@Ziplin - I know, but at the time I posted this answer I did not have enough reputation to comment. It is generally not a good idea to give a web server any sort of root permissions unless absolutely necessary. –  Zhehao Mao Jun 20 '11 at 20:09
add comment

NOTE: You should never edit the sudoers file directly. This can result in a sudoers file that cannot be used. The command visudo should be used to manipulate the sudoers entry, as using this command basically syntax checks the file to prevent bad file entries and locks anyone else out from editing the file. I'm wondering if this might be part of the problem in that somebody did a visudo and it kicked out the entry for some reason.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.