Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I manage the hosting of a custom Software-as-a-Service (SAAS) CMS and Ecommerce system. This system is powered by a cluster of LAMP servers behind an HAproxy instance, and each customer / domain has their own unix account on the cluster and in LDAP. Each customer purchases a given amount of data storage which we manage using a cPanel server, so the quotas are enforced by standard linux kernel / NFS quotas.

I want to be able to provide disk space usage statistics in my customers' web admin dashboard. On the LAMP cluster as root I can run /usr/bin/quota domain.name to get the disk space used by any given domain. However our Apache instances run as UID www-data.

Is it safe to allow www-data to run sudo /usr/bin/quota with NOPASSWD?

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

If your sudoers configuration ensures that /usr/bin/quota is the only thing that www-data is allowed to run with root privileges, then yes, this sounds reasonably safe.

However, it still is riskier than needed. A safer approach would be to set up a cron job to retrieve this information periodically (say, every 1-5 minutes) and output it to a file that www-data has access to read.

share|improve this answer
    
Thanks. My concern with a cron job is that it might be too delayed, e.g. if a user is trying to delete files to free up space. But if it ran every minute, that would probably be OK... –  Josh Apr 25 '12 at 22:47
add comment

Miles answer is right.. the correct approach is tie in some task queue system into your application and workers check the task queue for jobs to run.. they could check every second and have better control over the user they run as.. So you can avoid the cron delay.

share|improve this answer
    
Yep, this would work even better! –  Skyhawk May 2 '12 at 4:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.