0

I'm trying to run a shell script via php but I'm getting a permission error, however I'm trying to add permission to my www-data user to use the sudo command without a password, but it's not working, I don't know if I'm reporting anything wrong. Below is how my "visudo" file is edited.

www-data ALL=(ALL) NOPASSWD:/var/www/mysite/classes/builder-sites-nginx.sh
www-data ALL=(ALL) NOPASSWD:/var/www/mysite/classes/MyClassToCallScript.php

My code PHP is:

$command = "sudo sh ".dirname(__FILE__)."/builder-sites-nginx.sh {$domain}";
// dump($command);
$response = shell_exec($command);

My code Shell:

#!/bin/bash

FILE_FROM=/etc/nginx/sites-available/sites-builders
FILE_TO=/etc/nginx/sites-enabled/"$1"

[ ! -d "$FILE_FROM" ] && mkdir -p "$FILE_FROM"

if test -f "$FILE_TO"; then
    echo "syntax is ok. $FILE_TO already exists"
else
        ln -s "$FILE_FROM/$1" /etc/nginx/sites-enabled/

        #check stats
        if nginx -t > /dev/null 2>&1; then
                echo "syntax is ok"
                service nginx reload
        else
                echo "syntax is not ok"
                rm "$FILE_TO"
        fi
fi

But my response is "empty". I did a test by adding the following excerpt to my "visudo"

www-data ALL=(ALL) NOPASSWD:ALL

Using the way I mentioned above works, but I believe that the security of my site will be at risk, correct? Why my apache user will have sudo permissions and if someone puts in some malicious file I will be in trouble, so I come back with my initial question, the way I am putting the path to "visudo" in just executing the given script is right?

1 Answer 1

3

You're not running sudo /var/www/mysite/classes/builder-sites-nginx.sh, you're running sudo sh /var/www/mysite/classes/builder-sites-nginx.sh - and sudo isn't configured to allow www-data to run sudo sh (and nor should it be - that would be an enormous security hole, equivalent to www-data ALL=(ALL) NOPASSWD:ALL).

Make /var/www/mysite/classes/builder-sites-nginx.sh executable with chmod +x, and make sure that it has #!/bin/bash as the first line (#!/bin/sh would work too because your script doesn't use any bash-only features).

Then modify your PHP code to:

$command = "sudo ".dirname(__FILE__)."/builder-sites-nginx.sh {$domain}";

BTW, depending on where and how $domain was defined (i.e. if it came from user-supplied data), you may need to use PHP's escapeshellcmd() function to sanitise it.

12
  • thanks to answer, I made the changes as you suggested, I added the permission chmod +x in the file builder-sites-nginx.sh and change my php, but when I run php it is returning "null" in the response from shell_exec, and should return some text, as if syntax is ok or not. Print return: prnt.sc/12plwv7
    – Crazy
    Commented May 9, 2021 at 7:06
  • does it run from the command line? e.g. sudo -u www-data -s /bin/bash to get a shell as www-data, followed by sudo /var/www/mysite/classes/builder-sites-nginx.sh
    – cas
    Commented May 9, 2021 at 7:34
  • if I understand correctly, is it to do a test like this? sudo -u www-data -s /bin/bash sudo /var/www/mysite/classes/builder-sites-nginx.sh ? IF it is, I did it and it didn't work... I make a test using on terminal: sudo /var/www/mysite/classes/builder-sites-nginx.sh but not working too.. my response is: sudo: ....builder-sites-nignx.sh: command not found, thanks for help again!
    – Crazy
    Commented May 10, 2021 at 7:53
  • That was two commands. 1. sudo -u www-data -s /bin/bash. This gives you a shell as user www-data. 2. Next, try to run the script with sudo while in the www-data shell, sudo /var/www/mysite/classes/builder-sites-nginx.sh. You could do it as one command with sudo -u www-data sudo /var/www/mysite/classes/builder-sites-nginx.sh. Anyway, if the script doesn't run with sudo from the command line, it's a problem with the script, not sudo.
    – cas
    Commented May 10, 2021 at 8:04
  • BTW, you almost certainly don't need (and shouldn't have) ..../MyClassToCallScript.php executable via sudo. You only need the shell script that it calls, ...../builder-sites-nginx.sh, to be run as root by www-data.
    – cas
    Commented May 10, 2021 at 8:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .