Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am making a system call from php which is

`sudo /usr/bin/perl -pi -e 's/foo/bar/g' /tmp/newxml.xml`;

which works fine in php cli. But would not work in php via browser, because apache does not have required execution permissions. How do I make apache a sudoer to allow to run only /usr/bin/perl ?

I understand that will have to edit /etc/sudoers to do this, but I am not sure how its to be done. Any pointers?

I am running RHEL 5.5

share|improve this question

migrated from stackoverflow.com Jul 2 '12 at 15:25

This question came from our site for professional and enthusiast programmers.

3 Answers 3

up vote 4 down vote accepted
visudo

add

nobody ALL=(ALL)NOPASSWD:/usr/bin/perl

replace nobody with whatever your apache user is.

But you shouldn't do that. Giving apache sudo access to perl essentially gives anyone instant root to your box who compromises a php application of yours.

You should check the umask for /tmp/newxml.xml and make sure it's writeably by your apache user.

share|improve this answer
3  
I love those accepted answers which contain a “you should not do that” without an “do this instead” :). –  Jonas Wielicki Jul 2 '12 at 15:00
1  
You should check the umask for /tmp/newxml.xml and make sure it's writeably by your apache user. Read before you post :) –  lawl0r Jul 2 '12 at 15:15

I don't think that giving the apache user sudo rights would be wise from a security point of view. Have you considered changing the ownership of that file on group level so apache can write to it without the need for sudo?

share|improve this answer
3  
Absolutely. I nearly choked when I thought about giving sudo access to apache –  hellsgate Jul 2 '12 at 13:48
    
I changed the permissions and ownership... still no luck... any other alternatives on your mind? –  user1263746 Jul 2 '12 at 14:16
    
What failure are you getting now? –  nickisfat Jul 2 '12 at 14:21
    
My http error log says : "Can't remove newxml.xml: Permission denied, skipping file." –  user1263746 Jul 2 '12 at 14:58
    
Then there's still a permission issue; verify that the process owner has read access on the dir in which the file is contained. Also check whether the process is running in a chroot jail and so cannot access the path in question –  nickisfat Jul 2 '12 at 15:14

First, you could do the same thing from within php without the need for a call to perl.

Second, as you're running rhel, it's probably SELinux which got in your way. Try to run setroubleshooter, it will give you the neccessary information on how to fix this.

Third: Do not give root to apache, nor sudoers rights or anything alike.

share|improve this answer
    
Can do from php, but cant as it needs to be done by perl for a particular reason. I disabled SELinux before getting into this problem. Point noted for not giving root to apache :) –  user1263746 Jul 2 '12 at 14:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.