0

I want to run a bash script from web-server that chmod's other folder.

My bash file (it's owned by root:www-data, chmod 775):

#!/bin/bash
chown root:www-data /etc/cron.d/gtest
chown root:www-data /etc/cron.d/teststtest

My php file that runs the bash script:

<?php
exec("/var/www/html/script/script.sh");
?>

When I run the file from command-line(putty) when logged with root - it's ok. But can't run it from web-server. It runs but doesn't chown. Any solutions?

  • 1
    I'm guessing (hoping, really) that your web server does not run as the root user (and hence cannot perform chown within /etc/cron.d/) – Jedi Nov 23 '16 at 14:22
  • 1
    What are you actually trying to do? – Michael Hampton Nov 23 '16 at 18:42
3

The user under which your web server PHP runs under does not have privileges to chown those directories. And it shouldn't have any such privileges, because that would be a big security issue.

You need to find some other way of implementing what you want to do.

0

All of the tools you need to diagnose this problem are at your fingertips but you seem not to be using them.

The php exec command returns information that you can use to diagnose your issue, specifically

string exec ( string $command [, array &$output [, int &$return_var ]] )

The return string will likely contain information that is helpful. If it does not then you can get extended information bu providing an array for the output to be added to. Reading the rest of the documentation for the php exec command would bge useful too there is more helpful information in it.

0

There are some huge security headaches here, so you will need to be extremely careful. You can place the www-data user in the sudoers file and give the explicit path to the script you wish to run as root. It is imperative that you state only the script you wish to run as root, otherwise some miscreant could break out into your entire system.

visudo

and then add the following:

www-data ALL = NOPASSWD: /var/www/html/script/script.sh

You should be able to call the script like this:

<?php exec("sudo /var/www/html/script/script.sh"); ?>

If I'm honest, I'm not particularly keen on this. The www-data user should have as least permissions as possible. Although we have reduced the attack vector considerably by explicitly stating exactly what we want to execute as root, it may be worth shifting those chown operations into root's crontab to run periodically, rather than be called by a script (if you actually need to chown those directories in such a way, which seems like another massive security hole too).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.