Run root script from www-data user

Question

I have a problem to run a command that requires root privileges via php on the apache server

1. I added a command to sudoers so that it does not require a password for the user

visudo:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path = "/ usr / local / sbin: / usr / local / bin: / usr / sbin: / usr / bin: / sbin: / bin"

# Host alias specification

# User alias specification
# Cmnd alias specification

# User privilege specification
root ALL = (ALL: ALL) ALL

# Allow members of group sudo to execute any command
% sudo ALL = (ALL: ALL) ALL

# See sudoers (5) for more information on "#include" directives:

#includedir /etc/sudoers.d

www-data ALL = NOPASSWD: / sbin / iw

2. Php script that I am trying to execute, I also check the error that is returned

<? php
echo '<pre>';
$ last_line = system ('sudo / sbin / iw wlan0 scan 2> & 1', $ retval);
// Printing additional info
echo '
</pre>
<hr /> Last line of the output: '. $ last_line. '
<hr /> Return value: '. $ retval;
?>

php script returns

sh: 1: sudo: not found

Last line of the output: sh: 1: sudo: not found Return value: 127

sudo is installed, and works fine when I execute from other user

whoami returns "www-data" so user is ok

www-data belongs to the

sudo group

groups www-data
www-data: www-data sudo

Answer 1

First, this line is wildly wrong:

www-data ALL = NOPASSWD: / sbin / iw

If you had used visudo to edit the sudoers file you would have been warned something like this (for a line number XXX):

>>> /etc/sudoers: syntax error near line XXX <<<

It's telling you that the syntax is wrong. Indeed, it should be this:

www-data ALL = NOPASSWD: /sbin/iw

However, syntax aside, the idea of having a web application with full and unrestricted access to iw doesn't seem a great idea. The usual approach would be to write a helper script that does the one or two things that are expected of the caller, and nothing more. For example, if you're only interested in scanning, don't allow the script to do anything other than scan. The www-data account would be given root rights to this script, not to iw, so that even if someone managed to break through your web application they could only do whatever it was that the webserver could do.

Second, this line is also wrong:

last_line = system ('sudo / sbin / iw wlan0 scan 2> & 1', $ retval);

I'm not sure why you would think that / sbin / iw was a meaningful command, and running this gives an error:

sudo / sbin / iw wlan0 scan 2> & 1
-bash: syntax error near unexpected token `&'

Use the correct syntax:

sudo /sbin/iw wlan0 scan 2>&1

Third, you don't say what host this is running on, but your www-data account may not have rights to access /usr/bin/sudo. It's trickier to diagnose this without additional information.