3

I am making a system call from php which is

`sudo /usr/bin/perl -pi -e 's/foo/bar/g' /tmp/newxml.xml`;

which works fine in php cli. But would not work in php via browser, because apache does not have required execution permissions. How do I make apache a sudoer to allow to run only /usr/bin/perl ?

I understand that will have to edit /etc/sudoers to do this, but I am not sure how its to be done. Any pointers?

I am running RHEL 5.5

4 Answers 4

6
visudo

add

nobody ALL=(ALL)NOPASSWD:/usr/bin/perl

replace nobody with whatever your apache user is.

But you shouldn't do that. Giving apache sudo access to perl essentially gives anyone instant root to your box who compromises a php application of yours.

You should check the umask for /tmp/newxml.xml and make sure it's writeably by your apache user.

2
  • 4
    I love those accepted answers which contain a “you should not do that” without an “do this instead” :). Jul 2, 2012 at 15:00
  • 2
    You should check the umask for /tmp/newxml.xml and make sure it's writeably by your apache user. Read before you post :)
    – lawl0r
    Jul 2, 2012 at 15:15
8

I don't think that giving the apache user sudo rights would be wise from a security point of view. Have you considered changing the ownership of that file on group level so apache can write to it without the need for sudo?

6
  • 3
    Absolutely. I nearly choked when I thought about giving sudo access to apache
    – hellsgate
    Jul 2, 2012 at 13:48
  • I changed the permissions and ownership... still no luck... any other alternatives on your mind? Jul 2, 2012 at 14:16
  • What failure are you getting now?
    – nickisfat
    Jul 2, 2012 at 14:21
  • My http error log says : "Can't remove newxml.xml: Permission denied, skipping file." Jul 2, 2012 at 14:58
  • Then there's still a permission issue; verify that the process owner has read access on the dir in which the file is contained. Also check whether the process is running in a chroot jail and so cannot access the path in question
    – nickisfat
    Jul 2, 2012 at 15:14
1

First, you could do the same thing from within php without the need for a call to perl.

Second, as you're running rhel, it's probably SELinux which got in your way. Try to run setroubleshooter, it will give you the neccessary information on how to fix this.

Third: Do not give root to apache, nor sudoers rights or anything alike.

1
  • Can do from php, but cant as it needs to be done by perl for a particular reason. I disabled SELinux before getting into this problem. Point noted for not giving root to apache :) Jul 2, 2012 at 14:11
1

Better to restrict apache's access to just the Perl command you need to run and not to Perl as a whole and not to root. Create a wrapper script around Perl for this. Create a new user or find a suitable one. In this example that user is bob:

EDITOR=emacs                              #or other favorite editor
visudo -f /etc/sudoers.d/apache_foobar    #safe edit as root

Add this line, save and exit editor:

apache ALL=(bob) NOPASSWD: /the/path/myscript

Then put this in /the/path/myscript

#!/bin/bash
echo "Hello, I'm "`whoami`  #should see bob
/usr/bin/perl -pi -e 's/foo/bar/g' "$1"

Replace "$1" with /tmp/newxml.xml if that's the only file you have to operate on.

The script only have to be readable+executable to bob, not apache or others:

chown bob:bobsgroup /the/path/myscript
chmod 500 /the/path/myscript

Now user apache should be able to run this as user bob in your php:

`sudo -u bob /the/path/myscript /tmp/newxml.xml`;

If bob is a newly created user for the purpose, you might have to add bob to /etc/shadow. (note: SELinux can cause trouble for this setup, but that's also solvable)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .