Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using redhat 6 I have the following shell commands that I need to run from the webserver (apache -> through php ) that basically move & overwrite a file , kill a process and starts another . Obviously for some reasons all the operations are denied so I'm wondering if there is any way to execute them (e.g. what permission and how should I give to apache )

echo  shell_exec('mv -f /etc/resolv.test /etc/resolv.conf');
echo  shell_exec('killall horas');
echo  shell_exec('/xg/eng/sbin/startme &> /dev/null &');

the error log is mv: cannot move /etc/resolv.test' to/etc/resolv.conf': Permission denied horas(2105): Operation not permitted horas: no process killed

share|improve this question
    
Do your clients know you are doing this? If I were them, I'd run away as fast as possible. –  Deer Hunter Jan 18 '13 at 20:10
    
@Deer what clients ? I'm running my own stuff . –  user1963938 Jan 18 '13 at 20:59
add comment

3 Answers

up vote 1 down vote accepted

well I'm aware that apache runs under apache but I think the question is how to give more permissions to apache so it can execute all these commands

the typical way to do this is to grant apache sudo access with NOPASSWD. you will want to be overly cautious with this because this can be exceedingly dangerous if misconfigured. something like

apache    ALL=(ALL) NOPASSWD: killall horas

might work. you might also want to write the whole thing up as a "wrapper" script and then only grant apache sudo access to that one script. (another reply recommends this as well.)

remember, you are granting apache both execution AND privilege escalation. this is potentially a root-level remote exploit. test your scripts before deploying it and make sure you investigate securing access to the page with basic authentication and/or IP allows. you may also be better served investigating alternate solutions. does apache really need to manage your resolv.conf? could a cronjob perform the killall?

share|improve this answer
1  
+1 for answering the question, but also stating strongly that it's a terrible idea. Unfortunately, it's hard to stop people doing stupid things, but let's hope. –  Lattyware Jan 18 '13 at 18:56
add comment

Apache processes runs normally as a special user ('apache' normally in Redhat). Find that out first. Then, you need to check that that user is allowed to perform that operation (files/dirs permissions).

It's very dangerous to let the user that runs the web server have big privileges to execute sensitive scripts that only root should perform. I don't know exactly your scenario, but judging from the snippet, I'd go with something more cautios as having a frequently running (once per minute) cron script (for root user perhaps) that just checks for the existence of some file, that is generated by the php script - if the file is present, it executes the task and removes the file.

share|improve this answer
    
well I'm aware that apache runs under apache but I think the question is how to give more permissions to apache so it can execute all these commands . –  user1963938 Jan 18 '13 at 18:15
2  
@user1963938 What this answer is telling you is giving those permissions to apache is a bad idea. It pretty much defies the point of running apache as a limited user (or rather, stops that being the case). –  Lattyware Jan 18 '13 at 18:55
    
all the requests are made by my API / application so the "user" is not dangerous. –  user1963938 Jan 18 '13 at 19:20
    
see also here: stackoverflow.com/a/9873970/277304 –  leonbloy Jan 18 '13 at 19:23
add comment

I usually do one of the following:

  • Make php update a database and have a minutely cronjob running as the correct user that checks that database. This will introduce a delay, but is safest
  • Wrap all these commands in a shellscript and make apache run sudo -u correctuser_here /path/to/script and of course add permissions for this to /etc/sudoers: www-data ALL=correctuser /path/to/script
  • And my favourite: use queueing software (I'm partial to beanstalk as it's simple): Make php add an item to a queue and have a daemon in the background constantly retrieve and process items.

In your usecase option 2 sounds like the right thing to do.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.