How do I get simple scripts which seem to need root priveliges to run via the www-data user?

Question

I am programming a small webinterface to control samba on Debian (kernel 2.6.32-5-686). I started by writing simple scripts to add users, create folders, etc. They worked fine when run as root. However, when run via web (apache + php) by using php: shell_exec() some of them didn't work. They look like this:

#!/bin/sh
#archive the userprofile
cp /home/samba/profile/$1 /home/samba/archive/$1
smbpasswd -LU $1 -x
userdel $1 
exit 0

I tried using sudo to run the scripts, which doesn't seem to work. I added this line: (jupiter is the servers name)

%sudo jupiter=(ALL)NOPASSWD:/bin/<script>

to the /etc/sudoersfile, gave my www-data user the sudo group, nothing.

Then I read somewhere I should chmod 4755 and chown the scripts. It still didn't work.

At this point I was curious what the problem was and I redirected the STDERR to a file. I ran one of the small scripts, which would call cp, smbpasswdand userdel to delete the user and archive his share. All calls returned the exitcode 1, which AFAIK indicates that something went wrong. STDERR gave me a little clue:

userdel: cannot lock /etc/passwd; try again later.

This seems to be caused by some *.lock files, but there are none in my /etc/ folder.

At this point I got kinda frustrated and tried giving the www-data more root rights by adding it to the root group. Things still didn't work.

So far for my progress, I have no idea what to do next. My question is: How do I get simple scripts which seem to need root priveliges to run via the www-data user? I think it might be a problem with the /etc/passwd file, as I can imagine only the root-user has the right to alter it.

Answer 1

my answer is only related to the line

sudo jupiter=(ALL)NOPASSWD:/bin/<script>

---

With this line you allow user sudo to run /bin/<script> on host juptier as any user without authentication. I don't think that you want this.

If i have understood correctly you want the user www-data to execute /bin/<script> as root. In this case the appropriate line looks like

www-data jupiter=(root) NOPASSWD:/bin/<script>

Now you can execute /bin/<script> as www-data with root privileges by invoking

www-data:~ $ sudo /bin/<script>

or via shell_exec("sudo /bin/<script>") in your php-script (I hope you cared about security issues).

For further details look at man sudoers or the online version sudoers.man. For a quick understanding i recommend to take a look at the EXAMPLES section.