Running Fedora 9/10, Apache 2, PHP 5…
Can I run a shell script as root, from a PHP script using exec()?
Do I just give Apache root priveleges, and then add ‘sudo’ in front of them command?
Specifically, I’m trying to start and stop a background script.
Currently I have a shell script that just runs the app, start.sh:
#!/bin/bash /path/to/my/app/appname And a script that kills the app, stop.sh:
#!/bin/bash killall appname Would I just do:
<?php exec('sudo start.sh'); ?> Thanks in advance.
You can’t just sudo like that, you need to setup passwordless sudo first in /etc/sudoers file. This can be done with visudo command for example. Make sure you set up privileges in sudoers file in such way to constrain the apache user to that single command you wish to run (i.e. your shell script).
Even then, it poses a security risk, because anyone could create a PHP script and run your shell script in turn. So make sure that shell script itself is secure from alteration by Apache user.
The second part, killall, is even more problematic. You shouldn’t just allow Apache to run killall with root privileges. You should wrap killall in another shell script and grant access to that in sudoers.
In the end: do not run Apache with root account and do not use setuid. Both open a can of worms, and since you are a newbie (given the question you asked) you are very likely to miss some of small details that would create potential problems.