-1

I am being told the following two statements about running scripts as sudo:

  1. The user executing the sudo command must also have execute permission to the file
  2. Only the file will execute as root and not the commands within

I have no reason to doubt what I am being told, however I have the following setup which is working and I would like to know why, if the above two statements are correct.

I have the following script:

/var/www/bash_scripts/test/set_permissions.sh

The script contains the following content:

chown -R jason:www-data /var/www/test.site.com
find /var/www/test.site.com -type f -exec chmod 664 {} \;
find /var/www/test.site.com -type d -exec chmod 775 {} \;

The permissions of this script are:

-rwxrwxr-- 1 root root 200 Nov 21 22:49 set_permissions.sh

My /etc/sudoers file contains the following line appended to the bottom:

www-data ALL=(ALL) NOPASSWD: /var/www/bash_scripts/test/set_permissions.sh

When the script is executed via a php process running as user www-data, the script executes as expected and all commands within are carried out.

If statement 1. from above is correct, the script should never execute as it is only executable via the root user. If statement 2. from above is correct, the commands within the script would have failed to execute.

I am simply looking for some clarification as to whether or not the two statements are correct and if they are, what have I done that would allow the behavior I have described above?

EDIT

www-data owns /var/www/test.site.com

The php code runs the command via: exec('sudo /var/www/bash_scripts/site/test/set_permissions.sh 2>&1')

0

2 Answers 2

5
  1. The user executing the sudo command must also have execute permission to the file

Statement 1 is not accurate. The user executing sudo does not need to have execute permissions on the script.

  1. Only the file will execute as root and not the commands within

Statement 2 is also not accurate. All the commands in the script invoked by the sudo user will run as the sudo user.

Here's a simple test script I ran to show the id of the user the script/command is running as.

/tmp $ id
uid=1000(danesh) gid=1000(danesh) 

/tmp $ ls -l test.sh 
-rwxr-xr-x 1 danesh danesh 24 Nov 22 10:48 test.sh*

/tmp $ ./test.sh 
uid=1000(danesh) gid=1000(danesh) 

/tmp $ sudo ./test.sh
[sudo] password for danesh: 
uid=0(root) gid=0(root) groups=0(root)

/tmp $ sudo chown root:root test.sh
/tmp $ sudo chmod 770 test.sh
/tmp $ ls -l test.sh
-rwxrwx--- 1 root root 24 Nov 22 10:48 test.sh*

/tmp $ ./test.sh
fish: The file “./test.sh” is not executable by this user

/tmp [126] $ sudo ./test.sh
uid=0(root) gid=0(root) groups=0(root)


/tmp $ cat test.sh 
#!/usr/bin/env bash
# show the user executing this script
id

Hope that helps.

1
  • Following on from statement 1, the invoking user doesn't need any access at all to the file (to the point that it might be in an inaccessible directory) as long as the target user has the necessary permissions. Commented Dec 1, 2019 at 22:35
3

The two statements

The user executing the sudo command must also have execute permission to the file. Only the file will execute as root and not the commands within.

Are completely wrong.

In addition, shell scripts don't need execute. Execute only makes them easier to use, as then the #! at the top is used to determine the interpreter. However you can tell an interpreter, directly, to run the script. Therefore you only need read permission.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .