0

I have added the following single line to /etc/sudoers via command visudo:

www-data ALL=(ALL) NOPASSWD: /var/www/db_backup.sh

Upon executing the command as www-data via:

sudo -u www-data /var/www/db_backup.sh

I receive the following message:

sudo: unable to execute /var/www/db_backup.sh: Permission denied

Unsure why this would be as I have used this same procedure in the past without issue. There must be something I am overlooking. Does anything point out to anyone. My /etc/sudoers file is listed below:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL


www-data ALL=(ALL) NOPASSWD: /var/www/db_backup.sh



# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

Also as a side note when attempting to run the command sudo /var/www/db_backup.sh from within a php process running under www-data the following message is received (although I gather that's just from the issue with the permissions not being picked up from the sudoers file?):

sudo: no tty present and no askpass program specified

EDIT

ls -al /var/www/db_backup.sh

yields the following result:

-rwxrwx--- 1 root root 523 Jan 7 2019 /var/www/db_backup.sh

4
  • Please add the output of ls -al /var/www/db_backup.sh .
    – schaiba
    Nov 22, 2019 at 14:35
  • @schaiba Question has been updated. Nov 22, 2019 at 14:43
  • @Christopher so even though the user has sudo access to run the file with root permissions, it still needs to have executable permissions to that file? Nov 22, 2019 at 14:49
  • @Christopher the script runs several root level commands that are executed when a specific php script is invoked via nginx (custom code deployment script). The purpose of the shell script is to allow www-data sudo permissions to execute that file instead of giving www-data access to those commands. Nov 22, 2019 at 15:00

1 Answer 1

1

As noted in the comments, your script is not executable by other users. So, as mentioned, change user ownership and group ownership, then mark it as executable : chown www-data:www-data /var/www/db_backup.sh && chmod +x /var/www/db_backup.sh . Regarding your second problem, it should be asked separately, but anyway, without knowing exactly what the script contains, it's hard to tell what's wrong.

6
  • So just to confirm, if you grant a user sudo access via sudoers, that user also must have execute permissions on that script? Nov 22, 2019 at 15:09
  • yes, that is correct. two different things.
    – schaiba
    Nov 22, 2019 at 15:10
  • This allows the script to execute, but when it attempts to execute commands inside of the script that require root privilege, they all fail. Which points me back to the configuration of /etc/sudoers not being read/loaded correctly. Nov 22, 2019 at 15:24
  • 1
    the config is loaded correctly. your NOPASSWD line in /etc/sudoers allows the script to execute via sudo, NOT the commands inside it.
    – schaiba
    Nov 22, 2019 at 15:28
  • 1
    @schaiba The user running the sudo command does not need execute permissions on the script, only the user that you're changing to (e.g. www-data) needs execute.
    – doneal24
    Nov 22, 2019 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .