I have a perl program that runs fine when called through the Internet via apache on Fedora Linux server. In that perl script I have a system command which does not run because it needs to be run as root. I realize all the security ramifications but surely there must be a simple way of clearing a path for a legitimate script to do a legitimate function as root. I have tried using sudo but I have to remove the requiretty restriction for the apache user and I don't want to weaken security. There should be a way in apache config to either allow a specific file or directory to run as root but I have not been able to find it. I don't want all cgi-bin to run as root. Any help is appreciated.

  • Ramifications a plenty... – Simon Catlin Aug 17 '12 at 20:50

Perl? Perl supports setuid scripts.


Perl is a notable exception. It explicitly supports setuid scripts in a secure way. In fact, your script can run setuid even if your OS ignored the setuid bit on scripts. This is because perl ships with a setuid root helper that performs the necessary checks and reinvokes the interpreter on the desired scripts with the desired privileges. This is explained in the perlsec manual. It used to be that setuid perl scripts needed #!/usr/bin/suidperl -wT instead of #!/usr/bin/perl -wT, but on most modern systems, #!/usr/bin/perl -wT is sufficient.

|improve this answer|||||
  • Thanks. I tried the -wT and got this error: Insecure $ENV{PATH} while running with -T switch – xivix Aug 17 '12 at 21:02
  • For "Insecure $ENV{PATH}" messages, you need to set $ENV{'PATH'} to a known value, and each directory in the path must be non-writable by others than its owner and group. – chx Aug 17 '12 at 21:10
  • how do I set that? – xivix Aug 17 '12 at 22:04
  • $ENV{'PATH'} = '/bin:/usr/bin'; – chx Aug 17 '12 at 22:39
  • Ok, I put that under the #!/usr/bin/perl -wT line ... but I still get command exited with value 512 – xivix Aug 17 '12 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.