I have a perl script dhcpmanip.pl which contain this line:

system "hostapd /etc/hostapd-1.0/hostapd/hostapd.conf"`

It's a command to start hostapd and I get this error :

Insecure `$ENV{PATH}` while running setuid at `/var/www/cgi-bin/dhcpmanip.pl` line 46

After searching on the net I realised that I should accord root permission to www-data user (apache user) then I tried to modify the file /etc/sudoers by inserting this line:

www-data ALL=NOPASSWD: /var/www/cgi-bin/dhcpmanip.pl

but it still not working...does anyone have any idea about how solving this problem?

migrated from serverfault.com Jun 29 '13 at 15:04

This question came from our site for system and network administrators.

  • system "sudo hostapd /etc/hostapd-1.0/hostapd/hostapd.conf " – fsoppelsa Jun 28 '13 at 15:04
  • This isn't a permissions issue, but a check the perl interpreter does (on suid scripts I think) to avoid privilege escalations. – Falcon Momot Jun 29 '13 at 0:13
  • 1
    NB! Granting ALL=NOPASSWD privileges to www-data is equal as running web services as root - this is totally insecure! – SaveTheRbtz Jun 29 '13 at 3:23
  • I agree with SaveTheRbtz - please don't do that! The internet does not need more cracked webservers. – Jenny D Jun 29 '13 at 8:22
  • @SaveTheRbtz Actually it's only giving permission to run that one command with elevated privilege. – bahamat Feb 5 '14 at 8:51

You're getting that message because perl is running in taint mode. Either you've set that explicitly (good) or perl turned that on itself because what you're doing is dangerous (bad, but perl is is still doing good).

Either way, perl requires you to sanitize your PATH before it will execute external commands.

You need to explicitly set $ENV{PATH} somewhere in your script prior to executing any external commands.

For good practice you should also explicitly use the full path of any external commands you are running.


Depending on where hostapd is actually placed, you'd need to set $ENV{PATH} to something. For example, if it was in /usr/bin set $ENV{PATH} = "/usr/bin" and it should work.


As I understand it, you want to be able to go to a particular web page on your computer, and that will make the computer run a script that will manipulate your dhcp setting. As SaveTheRbtz said, this is not the secure way to go about it.

When you're running a web server, you want to be sure that any scripts run by the web server have a very limited access to do things on your server. Otherwise, any small mistake in your scripts may lead to some script kiddie getting root on your server and abusing it.

So, if you have a script that needs root access, that script should not be run by the webserver user. I would instead use a somewhat more complex setup:

  • Create a CGI script that will only write an entry to a file. This requires minimal rights, and done properly (i.e. by overwriting the previous entry instead of adding to it) it will not even risk filling up your disk if someone were to hit it multiple times.
  • Create a cron job that regularly checks that file to see if it's been changed. If so, run the script. The cron job can be owned and run by root, thus requiring no extra sudo setup.

This way, the web server user is completely isolated from what the script does that needs root access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy