Best way to have non-root user execute script with commands that require root access?

Question

I have a script that is executed by php so it runs as the www-data user. The script is pretty simple, it basically copies some pre-made files such as the hosts and interfaces files to the correct directories. Maybe update some permissions etc.

I thought creating a new user and giving that access to the required commands only through visudo might work but

1. that still requests the user executing the .sh for a password and
2. it plainly does not give the test user permissions.

visudo (all permission denied when running ./script.sh)

test ALL=(ALL) NOPASSWD:ALL
test ALL=      NOPASSWD:ALL
test ALL=(ALL) NOPASSWD:/bin/cp,/bin/mv,/bin/nano,/bin/chown,/bin/mv

When I change the test user to the actual user I'm logged in with, it works.

.sh executed by the logged in/www-data user trying to execute the commands as a different user with the required permissions.

#!/bin/bash
sudo -H -u test cp test.txt /etc/test.txt
sudo -H -u test chown test /etc/test.txt
echo "ok"

What is the best way to enable the www-data user to execute a script that requires root permissions?

Answer 1

The sudoers part you have shown does not make sense.

test ALL=(ALL) NOPASSWD:ALL
test ALL=      NOPASSWD:ALL
test ALL=(ALL) NOPASSWD:/bin/cp,/bin/mv,/bin/nano,/bin/chown,/bin/mv

You want just one of these lines, probably the last one.

Executing echo "ok" with no respect to the exit code of the earlier commands doesn't make much sense either.

As far as you have shown there are no sudo permissions for the user www-data.

On a normal system sudo -H -u test cp test.txt /etc/test.txt doesn't make sense because the user test cannot create files in /etc. This would only work if the target file exists and has write permissions for the user `test.

However, sudo -H -u test chown test /etc/test.txt never makes sense because the only user which can call chown that way successfully is root.

solution

I guess what you need is this. A script

#!/bin/bash

cp ~test/test.txt /etc/test.txt &&
    chown test /etc/test.txt    &&
    echo 'ok' || echo 'failure'

1. Put that script in a path that is writable only by root

2. Create a sudo permission like this

   www-data ALL= NOPASSWD:/path/to/script.sh
   

3. Call the script as www-data like

   sudo /path/to/script.sh