Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few scripts in a directory which I need www-data to run (from PHP) with root permissions. It seems like

CMND_ALIAS= /path/to/script, /bin/sh


gives www-data a little much freedom, since couldn't it execute any script using /bin/sh at that point? Yet, if I take /bin/sh off the alias, the scripts don't work. Does anyone know the proper way to specifically allow root access to ONLY a few scripts in /etc/sudoers?

share|improve this question

migrated from Aug 25 '11 at 18:06

This question came from our site for professional and enthusiast programmers.

Are you sure you need your web server to run them as root, rather than giving www-data access to whatever files you need modified? – Wooble Aug 24 '11 at 18:48
You could use a simple C wrapper which executes the shell scripts on your behalf, and grant sudo access to the wrapper. but that leads to other problems. – Marc B Aug 24 '11 at 18:58
It seems like giving www-data access to the files is worse in this case, as if it were compromised, I don't want www-data to be able to edit those files. If it can only sudo certain scripts to do what it needs to do, then if someone gained control of it, they couldn't do anything interesting. – Metaf5 Aug 26 '11 at 15:49

Sounds like a job for Apache's "suexec"

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.