Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Don't ask me why, but I have to find a way to allow the Apache user www-data to mount and unmount devices at run-time on the host system. Such devices are, for example, external USB drives on /dev/sdaXY formatted with NTFS filesystem.

I'm running the web service on a Debian machine using Apache 2.2 and PHP 5.3. When I try to run the mount command via PHP's exec() I obviously have these error message:

exec('mount /dev/sda1 /media/usb_flash');
// -> mount: only root can do that

exec('sudo mount /dev/sda1 /media/usb_flash');
// -> sudo: no tty present and no askpass program specified

exec('sudo -n mount /dev/sda1 /media/usb_flash');
// -> sudo: sorry, a password is required to run sudo

I'm aware only root can do that (in fact, from SSH, I always need sudo when mounting) and that www-data cannot be a sudoer. But I'm sure there's a way, a workaround, to make my task possible. I don't know where to start looking at: Googling my question is useless, I bet this is not a common scenario.

share|improve this question
    
Why can www-data not use sudo? –  Hauke Laging Mar 1 '13 at 18:24
    
See the PHP code I posted. Running sudo from PHP gives me sudo: no tty present and no askpass program specified error. –  lorenzo-s Mar 1 '13 at 18:25
    
OK, but that's not a user-specific problem (as your wording implies). –  Hauke Laging Mar 1 '13 at 18:26
    
@HaukeLaging May be. If so, what's the problem if not related to www-data? I tried also sudo -n, I'm updating my question. –  lorenzo-s Mar 1 '13 at 18:28
    
I know you said not to ask, but....why???? –  Grant Mar 2 '13 at 15:43

3 Answers 3

  1. Try the option requiretty in sudoers.
  2. An alternative is to run sudo within screen.
  3. If the mount points are static (and there is no risk that other users do harm with this) you may create an fstab entry for each of these mounts with the option user.
share|improve this answer
    
Tell me more about the /etc/fstab solution. I'm reading man fstab, but it's quite a mess for me. –  lorenzo-s Mar 1 '13 at 18:37
    
You need not read the whole file, ist about the user option only. But man 8 mount is more extensive about that: "Normally, only the superuser can mount filesystems. However, when fstab contains the user option on a line, anybody can mount the corresponding system." –  Hauke Laging Mar 1 '13 at 18:41
    
Unfortunately Unprivileged user can not mount NTFS block devices using the external FUSE library. Either mount the volume as root, or rebuild NTFS-3G with integrated FUSE support and make it setuid root. Please see more information at <tuxera.com/community/ntfs-3g-faq/#unprivileged>; –  lorenzo-s Mar 1 '13 at 19:56
    
@lorenzo-s Would have made sense to mention NTFS in the question. Go for sudo then. –  Hauke Laging Mar 1 '13 at 20:47
    
I solved in a simpler way today. See my self-answer. –  lorenzo-s Mar 2 '13 at 12:04
up vote 0 down vote accepted

I solved using pmount. After I found this tool, it looked the simplest solution to me (no sudoers edits, no fstab stuff, nothing).

pmount - mount arbitrary hotpluggable devices as normal user
pmount ("policy mount") is a wrapper around the standard mount program which permits normal users to mount removable devices without a match-ing /etc/fstab entry.

As the manual says, on Debian the permission to execute pmount is restricted to members of the system group plugdev. I had to run the following command once vis SSH, to add Apache usar to the plugdev group:

sudo adduser www-data plugdev

I restarted Apache, and now I can mount and unmount my USB drives from PHP without sudo:

exec('pmount /dev/sda1 usb_flash'); // Mounted on /media/usb_flash
exec('ls -al /media/usb_flash'); // List files, owned by www-data:600
exec('pumount usb_flash'); // Unmounted
share|improve this answer

The setuid flag may do the trick: create script that mounts your drive, own it by root, set the setuid flag on it and call this script from apache..

You can set required permissions(setuid and exec) with this command:

chmod 4711 <your/script>

where the first 4 is the setuid...

see setuid wiki for further reference.

share|improve this answer
    
SUID does not work with scripts. –  Hauke Laging Mar 1 '13 at 18:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.