How to call shell script from php that requires SUDO?

Question

I have a file that is a bash script that requires SUDO to work.

I can run it from the command line using SUDO but I will be prompted to put in the SUDO password.

I want to run this script from php via shell_exec but I if I call SUDO, its not like a command line where I can be prompted for the password. Is there a way to pass the password for sudo with the sudo call?

How can I do this?

Lingenfelter

By the way I am running this on my own ubunto 10.04 machine with apache2 and php5 – Lingenfelter

You should consider changing the permissions of the script. You could for example change the group to the apache user (www-data), and give the group execute permissions: chgrp www-data script.sh && chmod g+x script.sh. – Laudation

@danilo its not the file itself that requires the SUDO its what the files calls, which is svn commit but first I cd /var/www to call svn commit from the working copy. Is there a way I can add permissions to do that for apache user www-admin? – Lingenfelter

@John Isaacks: Ah. Take a look at the setuid bit: en.wikipedia.org/wiki/Setuid – Laudation

Why does svn commit need root? – Apollonius

@Stephen, I am new to all this so I don't know but it tells me permission denied unless I sudo it. – Lingenfelter

@John Isaacks : That is (almost) definitely a problem with your svn configuration. You don't want to start handing out root access to scripts to work around it, you'll end up with a mighty insecure system. Spend some time in the svn documentation to give yourself, and possibly "www-admin" access to sections of the svn repository. (I'd tell you myself, but it's been years since I've messed with svn) – Apollonius

Answer 1

Edit the sudoers file (with visudo) and add a rule that allows the web server user to run the command without a password. For example:

www-data ALL=NOPASSWD: /path/to/script

Aho

@ClaudioFerraro As long as the web server runs as the www-data user, it will work for any web server. – Aluminiferous

Answer 2

There are various solutions for this problem.

• First of all, consider changing the script permissions, if reason why you want sudo is simply a permission issue (see the comment I added to the question above).

• Another approach would be using the setuid bit. [Edit: Looks like setuid does not work well with scripts. For explananations, see this link.]

• A third, but very insecure method is to read the password from a password file. Warning: This is very insecure, if there's any other possibility, don't do it. And if you do it, try hiding the password file somewhere in your folder hierarchy.

  <?php
  shell_exec('sudo -u root -S bash script.sh < /home/[user]/passwordfile');
  ?>
  

• And a fourth possibility is to use the NOPASSWD tag in the sudoers file. You should limit this power to the specific commands you need.

Laudation

Changing the script permission won't run it as root, and setuid doesn't work on scripts – Aho

No, it won't run it as root, but it would solve the issue if the reason for the sudo usage is simply the script not being executable. And about the setuid thing, looks like you're right. In that case, excuse my misinformation. I found an useful link about this topic: faqs.org/faqs/unix-faq/faq/part4/section-7.html – Laudation

omg. NEVER SAVE A PASSWORD THAT HAS ROOT ACCESS! This has never been good form. @Brian's answer is much better: no passwords used. – Vespasian

Answer 3

You can add something like this to your sudoers file:

username ALL=NOPASSWD: /path/to/script

This will allow that particular user to call sudo on that particular script without being prompted for a password.

Anserine

This makes sense but one part confuses me... Where exactly do I put the line username ALL=NOPASSWD: /path/to/script What is my sudoers file? – Lingenfelter

In /etc/sudoers, though you usually use the visudo command to edit that file. – Anserine

Answer 4

The best secure method is to use the crontab. ie Save all your commands in a database say, mysql table and create a cronjob to read these mysql entreis and execute via shell_exec(). Please read this link for more detailed information.

  * * * * * killProcess.php

Dambrosio