Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a few scripts in a directory which I need www-data to run (from PHP) with root permissions. It seems like

CMND_ALIAS= /path/to/script, /bin/sh

www-data ALL=(ALL) NOPASSWD: CMND_ALIAS

gives www-data a little much freedom, since couldn't it execute any script using /bin/sh at that point? Yet, if I take /bin/sh off the alias, the scripts don't work. Does anyone know the proper way to specifically allow root access to ONLY a few scripts in /etc/sudoers?

share|improve this question

migrated from stackoverflow.com Aug 25 '11 at 18:06

This question came from our site for professional and enthusiast programmers.

2  
Are you sure you need your web server to run them as root, rather than giving www-data access to whatever files you need modified? –  Wooble Aug 24 '11 at 18:48
    
You could use a simple C wrapper which executes the shell scripts on your behalf, and grant sudo access to the wrapper. but that leads to other problems. –  Marc B Aug 24 '11 at 18:58
    
It seems like giving www-data access to the files is worse in this case, as if it were compromised, I don't want www-data to be able to edit those files. If it can only sudo certain scripts to do what it needs to do, then if someone gained control of it, they couldn't do anything interesting. –  Metaf5 Aug 26 '11 at 15:49

1 Answer 1

Sounds like a job for Apache's "suexec"

http://httpd.apache.org/docs/current/suexec.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.