I have a script that is executed by php so it runs as the www-data user. The script is pretty simple, it basically copies some pre-made files such as the hosts and interfaces files to the correct directories. Maybe update some permissions etc.
I thought creating a new user and giving that access to the required commands only through visudo
might work but
- that still requests the user executing the
.sh
for a password and - it plainly does not give the test user permissions.
visudo
(all permission denied when running ./script.sh
)
test ALL=(ALL) NOPASSWD:ALL
test ALL= NOPASSWD:ALL
test ALL=(ALL) NOPASSWD:/bin/cp,/bin/mv,/bin/nano,/bin/chown,/bin/mv
When I change the test
user to the actual user I'm logged in with, it works.
.sh
executed by the logged in/www-data
user trying to execute the commands as a different user with the required permissions.
#!/bin/bash
sudo -H -u test cp test.txt /etc/test.txt
sudo -H -u test chown test /etc/test.txt
echo "ok"
What is the best way to enable the www-data
user to execute a script that requires root
permissions?
$ sudo bash -c "./script.sh [arg1[ arg2]]"
where arg1, arg2 are optional script arguments. You may want to add the optionalsudo
flags:-E
to preserve the user's environment variables,-u test
to specify that usertest
runs the command. Just make sure thattest
is part of thesudo
group and that your script is executable. If this suits you,there is no need to modify yoursudoers
file in a way that makes your system vunerable to attacks.