How to allow `www-data` to call `supervisorctl status`?

Question

I have a PHP script that calls exec('supervisorctl status 2>&1', $output);, which runs as www-data user (through Apache).

However this user does not have access to this command. I would like to allow permissions for www-data only for this exact supervisorctl status command. It outputs the running supervisor processes very nicely and I'd like to show that in my webinterface.

# Running `supervisorctl status` under any user except root:
$ supervisorctl status
error: <class 'socket.error'>, [Errno 13] Permission denied: file: /usr/lib/python2.7/socket.py line: 228

I've tried adding this part to the /etc/sudoers file (using visudo) but it results in the same error (I possibly need more permissions since the error refers to python?) :

# /etc/sudoers
Cmnd_Alias SUPERVISOR_STATUS = /usr/bin/supervisorctl status

www-data ALL=(ALL) NOPASSWD: SUPERVISOR_STATUS

Answer 1

I got it to work. Apparently, when defining stuff in /etc/sudoers, this means that you are going to call commands with sudo.

So in order to execute it in php, I'd run:

exec('sudo supervisorctl status 2>&1', $output);

This should then work under www-data.

Answer 2

By default, non root users can execute supervisorctl command. The issue is with the socket permission. You need to move supervisor.sock to an accessible path by www-data. e.g: /tmp/

Change file, chown and serverurl varibles in your /etc/supervisord.conf for this:

[unix_http_server]
file=/tmp/supervisor.sock       ;custom
chown=carlos:mygroup       ; socket file uid:gid owner

[supervisorctl]
serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL  for a unix socket

After that, restart supervisor and check the status to make sure everything is ok.

systemctl restart supervisord
systemctl status supervisord