0

I want that a regular user to be able to execute apachectl in the system. And that would be the only thing that they can do outside of it normal permissions. What I did is to add this line at the bottom of the sudoers file:

sampleuser ALL=(root)      NOEXEC:/usr/sbin/apachectl

So, as the user sampleuser, I executed apachectl command, and I get this error:

$ sudo apachectl stop 
[sudo] password for sampleuser: 
/usr/sbin/apachectl: line 105: /usr/sbin/httpd: Permission denied

Now it seems like the permission is with the /usr/sbin/httpd command since apachectl script calls that executable file. So I added another line to the sudoers file:

sampleuser ALL=(root)      NOEXEC:/usr/sbin/httpd

Now I executed the same command and I get the same error:

sudo apachectl start
[sudo] password for sampleuser: 
/usr/sbin/apachectl: line 105: /usr/sbin/httpd: Permission denied

My question now, is that if there's a fix for this without having to edit the apachectl script file or another method that probably is easier than what I'm trying to do.

Thank you.

  • If I was to hazard a guess, it’s be that selinux doesn’t like a domain transition in there. – Jeff Schaller May 2 '18 at 19:55
  • @JeffSchaller But selinux is not active. getenforce Disabled – VaTo May 2 '18 at 20:02
  • Does ls -l /usr/sbin/httpd show root ownership and execute bits? – Jeff Schaller May 2 '18 at 20:06
  • @JeffSchaller Yes -rwxr-xr-x 1 root root 545024 Sep 24 2017 /usr/sbin/httpd* – VaTo May 2 '18 at 20:08
0

Apachectl does not know that it needs to use sudo to execute httpd

Try something like this:

APACHE_HTTPD='sudo -E /usr/sbin/httpd' sudo -E /usr/sbin/apachectl start

-E, --preserve-env
             Indicates to the security policy that the user wishes to reserve their
             existing environment variables.  The security policy may eturn an error
             if the user does not have permission to preserve the environment.

So you will force apache2ctl to use a different command to call httpd...

  • I get this error: sudo: sorry, you are not allowed to set the following environment variables: APACHE_HTTPD – VaTo May 2 '18 at 20:04
  • Apachectl stop is already running under sudo though... – Jeff Schaller May 2 '18 at 20:05
  • Yes, but it is just a script, when the script tries to call the subprocess httpd, the sudo will block it? I am not sure... – Luciano Andress Martini May 2 '18 at 20:06
  • Is it perhaps possible to give the user access to that env variable? – VaTo May 2 '18 at 20:07
  • Amazon Linux AMI release 2017.09 I think that's based on fedora ID_LIKE="rhel fedora" – VaTo May 2 '18 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.