0

I have a PHP script that calls exec('supervisorctl status 2>&1', $output);, which runs as www-data user (through Apache).

However this user does not have access to this command. I would like to allow permissions for www-data only for this exact supervisorctl status command. It outputs the running supervisor processes very nicely and I'd like to show that in my webinterface.

# Running `supervisorctl status` under any user except root:
$ supervisorctl status
error: <class 'socket.error'>, [Errno 13] Permission denied: file: /usr/lib/python2.7/socket.py line: 228

I've tried adding this part to the /etc/sudoers file (using visudo) but it results in the same error (I possibly need more permissions since the error refers to python?) :

# /etc/sudoers
Cmnd_Alias SUPERVISOR_STATUS = /usr/bin/supervisorctl status

www-data ALL=(ALL) NOPASSWD: SUPERVISOR_STATUS

2 Answers 2

1

I got it to work. Apparently, when defining stuff in /etc/sudoers, this means that you are going to call commands with sudo.

So in order to execute it in php, I'd run:

exec('sudo supervisorctl status 2>&1', $output);

This should then work under www-data.

0

By default, non root users can execute supervisorctl command. The issue is with the socket permission. You need to move supervisor.sock to an accessible path by www-data. e.g: /tmp/

Change file, chown and serverurl varibles in your /etc/supervisord.conf for this:

[unix_http_server]
file=/tmp/supervisor.sock       ;custom
chown=carlos:mygroup       ; socket file uid:gid owner

[supervisorctl]
serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL  for a unix socket

After that, restart supervisor and check the status to make sure everything is ok.

systemctl restart supervisord
systemctl status supervisord

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .