I am wanting to run some scripts which include iptables rules from Apache (running on port 81 on dd-wrt). I can't seem to get these to work because I lack the permissions. I'm hoping someone can point me at something I missed which does not require recompiling Apache.
I am running dd-wrt v3.0-r33525M kongac (10/16/17). I am running an instance of Apache on port 81.
I can't run Apache as root, because there appear to be compile directives/defaults preventing this behavior.
I can't run the scripts SUID (well, I can, but the SUID bit is being ignored because they are scripts).
I could be wrong, but the version of Busybox does not appear to have sudo functionality.
I can run the script from within the GUI running on port 80, but I would really like to build my own simple interface rather then giving more people access to this and having to run commands rather then just click on a link.
I expect I could do something with cron, but that I expect this will require cron to poll for a file, causing a delay which I would really like to avoid. Likewise I postulate I might be able to ssh to localhost and escalate my privs that way, but it would seem insecure and a lot of work.
iptables
to be setuid root, or if you prefer usesetcap
to set whatever capabilities it needs.iptables
directly accessible in your cgi directory