0

I'm making a php panel from which you can install apps like owncloud & plex on your server. I've created multiple bash scripts that install and remove software. I tested all of them from shell, everything works as it should. However, when I run the scripts from php as root using sudo on ubuntu 15.10, apt-get & dpkg are not working as they should.

In visudo I have:

seedbox ALL = (root) NOPASSWD: /bin/appinstaller

appinstaller is a bash script that run the install/uninstall apps bash scripts (e.g. appinstaller plex)

Plex script example:

dpkg --configure -a
cd /tmp
wget https://downloads.plex.tv/plex-media-server/0.9.15.6.1714-7be11e1/plexmediaserver_0.9.15.6.1714-7be11e1_amd64.deb
dpkg -i plexmediaserver_0.9.15.6.1714-7be11e1_amd64.deb

When I run appinstaller directly from bash everything works perfectly.

When I run appinstaller from php using (confirmed that script is running as root):

exec("sudo /bin/appinstaller plex > /home/installer.log 2>&1 &");

It works but I get apt & dpkg errors when I try to install other apps such as:

E: The package plexmediaserver needs to be reinstalled, but I can't find an archive for it. (even though it's installed and working)

And also dpkg --configure -a returns an error.

Plex is working fine, but seems like apt doesn't finish the installation process and gets stuck somewhere, also commands running after the apt-get install/dpkg won't run from php but will run from bash. I tried to run the script also from cron & systemctl and I get the same issue.

It's worth noting that some apps are installing/uninstalling without any issues.

What could be making the difference between running the script from php/cron/systemctl or from shell directly? Can I emulate normal bash session?

  • Is your "php panel" a web interface which you access via your browser? – Dmitry Grigoryev Feb 26 '16 at 7:32
  • Hi Dimitry yes it's a php web panel – J. Wilson Feb 26 '16 at 8:33
  • Did you try shell_exec instead of exec ? – the_velour_fog Feb 26 '16 at 9:03
  • 1
    I tried now shell_exec, same issue, plex was installed and seem to work properly, but then when I try to install another app I get: E: The package plexmediaserver needs to be reinstalled, but I can't find an archive for it. And apt-get stops. – J. Wilson Feb 26 '16 at 9:27
  • @the_velour_fog Differences between shell_exec and exec seem to be insignificant for this question. – Dmitry Grigoryev Feb 26 '16 at 9:48
0

Running PHP scripts as root is a dangerous practice. Web servers do their best to prevent privilege escalation, and implement various measures such as chroot jail. I believe that may be the cause of your problems.

In particular, dpkg needs to access files in /var/lib/dpkg/ to be able to function properly. You can check whether you have access to this directory from your PHP scripts, e.g. by trying to list files in it, or read from /var/lib/dpkg/status. If you don't (even when running as root), then you're indeed in a jail. You can of course just disable the jail (how to do it depends on the web server), but I wouldn't recommend it. There is a reason why it was implemented, and circumventing security mechanisms exposes you to all sorts of attacks.

  • I'm aware of the risk, and I'm willing to take it. I've tested and I can access these files from the bash script, so not in jail. – J. Wilson Feb 27 '16 at 7:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.