0

I have a problem to run a command that requires root privileges via php on the apache server

  1. I added a command to sudoers so that it does not require a password for the user

visudo:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path = "/ usr / local / sbin: / usr / local / bin: / usr / sbin: / usr / bin: / sbin: / bin"

# Host alias specification

# User alias specification
# Cmnd alias specification

# User privilege specification
root ALL = (ALL: ALL) ALL

# Allow members of group sudo to execute any command
% sudo ALL = (ALL: ALL) ALL

# See sudoers (5) for more information on "#include" directives:

#includedir /etc/sudoers.d

www-data ALL = NOPASSWD: / sbin / iw
  1. Php script that I am trying to execute, I also check the error that is returned
<? php
echo '<pre>';
$ last_line = system ('sudo / sbin / iw wlan0 scan 2> & 1', $ retval);
// Printing additional info
echo '
</pre>
<hr /> Last line of the output: '. $ last_line. '
<hr /> Return value: '. $ retval;
?>

php script returns

sh: 1: sudo: not found

Last line of the output: sh: 1: sudo: not found Return value: 127

sudo is installed, and works fine when I execute from other user

whoami returns "www-data" so user is ok

www-data belongs to the

sudo group

groups www-data
www-data: www-data sudo
3
  • hmm /usr/bin/sudo works fine May 15, 2022 at 15:29
  • Please don't put updates in comments. Edit your question. May 15, 2022 at 16:37
  • 1
    why do you have all those extra spaces around the / path separators and the redirection? are they actually in your sudoers file and php script? or are they some sort of copy-paste artifact?
    – cas
    May 16, 2022 at 2:09

1 Answer 1

0

First, this line is wildly wrong:

www-data ALL = NOPASSWD: / sbin / iw

If you had used visudo to edit the sudoers file you would have been warned something like this (for a line number XXX):

>>> /etc/sudoers: syntax error near line XXX <<<

It's telling you that the syntax is wrong. Indeed, it should be this:

www-data ALL = NOPASSWD: /sbin/iw

However, syntax aside, the idea of having a web application with full and unrestricted access to iw doesn't seem a great idea. The usual approach would be to write a helper script that does the one or two things that are expected of the caller, and nothing more. For example, if you're only interested in scanning, don't allow the script to do anything other than scan. The www-data account would be given root rights to this script, not to iw, so that even if someone managed to break through your web application they could only do whatever it was that the webserver could do.

Second, this line is also wrong:

last_line = system ('sudo / sbin / iw wlan0 scan 2> & 1', $ retval);

I'm not sure why you would think that / sbin / iw was a meaningful command, and running this gives an error:

sudo / sbin / iw wlan0 scan 2> & 1
-bash: syntax error near unexpected token `&'

Use the correct syntax:

sudo /sbin/iw wlan0 scan 2>&1

Third, you don't say what host this is running on, but your www-data account may not have rights to access /usr/bin/sudo. It's trickier to diagnose this without additional information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .