Executing a shell command from PHP with shell_exec

Question

Included in my thesis is to create an administration interface, in which an administrator can approve users whom have asked for access to use OpenNebula.

Upon approval the users should be added to OpenNebula (i.e. it corresponds to the command oneadmin createuser username password). (More information of the interface (section 4.2).)

I am trying to perform this with an execution of a shell command in a PHP file. Why doesn't this work (below is just a specific example - not the general code that I am using)?

$execQuery = "/bin/su oneadmin postgres -c '/usr/bin/oneuser create test10 test10'";
shell_exec ($execQuery); //execute query in shell.

Nor does this work (even though I am logged in as oneadmin, when the script is executed by PHP):

shell_exec ("/usr/bin/oneuser create test10 test10");

It works when I type that command in the shell. I have tried to execute other shell commands through php and those work fine, so I wonder where the problem lies.

I have given the file /usr/bin/oneuser rwx rights for all users.

Answer 1

On the php manual for shell_exec, it shows that the function returns the output as a string. If you expect output from the program you launch, you need to capture this like so:

$execQuery = "echo -n test_command";
$output = shell_exec($execQuery);
echo $output;

Your question doesn't show trying to capture any data. If you also make sure to connect stdout and stderr when you run your command, you should get a better idea is what is going on. To use your example:

$output = shell_exec("/usr/bin/oneuser create test10 test10 2>&1");
var_dump($output);

That should help you see what is going on. As Shadur suggests, it seems likely that these programs expect an interactive terminal that can enter passwords in order to run. Even if don't need input, they might expect interactive shells. And he's right that su doesn't play nice in this context. There is, however, a correct tool for the job.

You can setup sudo to such that your http user can execute your program as username without a password but NOT be able to do anything else by running visudo or whatever you use to edit your sudoers file and adding this line:

http    ALL=(username) /usr/bin/oneadmin

Then in php your command would look something like this:

$execQuery = "sudo -u username /usr/bin/oneadmin postgres -c '/usr/bin/oneuser create test10 test10'";
$out = shell_exec ("$execQuery 2>&1");
echo $out

Answer 2

Try passthru($cmd);

It will allow user's I/O on the Terminal screen.

Answer 3

In the first case, su generally asks for a password when you run it; shell_exec doesn't handle interactivity well.

I don't know oneuser, maybe it's trying to ask for some password as well?

Answer 4

First you need to permit your Webserver to Execute System commands. However in my instants I will be using CentOS6.3 64bit LAMP server.

First of all we need to know our current user that our apache uses, in most case its apache, lets check the the user name by PHP to make sure our username.

<?php
    echo shell_exec("whoami");
?>

in my case the output was apache, now let us edit the sudoer and give permission for our apache.

type below command to enter the sudoer file.

visudo

now append the below line end of your file, by this your apache will get full root access from PHP script.

apache  ALL=NOPASSWD: ALL

Now run below script from your PHP, this your should see the user as root,

<?php
    echo shell_exec("sudo whoami");
?>