Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am using libvirt-php to manage my virtual machines, and I need to shutdown/destroy domU.

For this I used the following php script:

< ? php $conn=libvirt_connect("xen:///");
$name=libvirt_domain_lookup_by_id($conn,4);
$dest=libvirt_domain_destroy($name);
echo $dest; ?>

When I run this on xampp server i get the following output:

Warning: libvirt_domain_destroy() [function.libvirt-domain-destroy]: operation virDomainDestroy forbidden for read only access in /opt/lampp/htdocs/xampp/byname.php on line 5.

Here is the documentation: http://libvirt.org/php/api-reference.html#libvirt_domain_destroy

share|improve this question
    
I'm no expert in livvirt-php, but I would imagine any type of delete operation would require appropriate permissions; I would start with that. The xampp server runs as www-data; you may need to give that user permissions to edit the virtual machine. –  Huckle Mar 25 '12 at 20:56
    
Yes you are right. Lets come to the xampp server. When I execute echo whoami; in Terminal, output: root. This verifies that I am logged in as root user. But when I execute this php-script < ?php echo whoami; ?> output: nobody. So did u know how to login as root in apache web server? Or how to make user and assign admin/root privileges? –  Alee Mar 26 '12 at 14:03
    
Giving Apache root permissions is a very dangerous idea. A compromise in Apache would mean a compromise to the entire server. A better idea would be to change the user apache runs as to that of a new user that has permissions only to the parts of the filesystem it needs. –  Huckle Mar 26 '12 at 22:22

1 Answer 1

up vote 1 down vote accepted

Depending on your version of Apache, your configuration files may reside in a different location, however the syntax is the same once you find the correct file.

To change the user and group that Apache runs as, edit these directives on the global scope:

User www-data
Group www-data

To make a system account for www-data that has no login-privileges, run the following:

sudo adduser --system --group --no-create-home www-data --quiet

Making this user account safe (e.g., by removing permissions to everything it doesn't need) is beyond the scope of this answer. Try a question like "How do I restrict user's access to filesystems and commands".

Giving www-data permissions to edit your virtual machine will likely either require adding www-data to another group which has permissions, or will require you to modify the groups of files on your system.

According to the FAQ for libvirt-php, all virtual machines run with the permissions of local users, so adding www-data to the group users might be all that is needed.

adduser www-data users
share|improve this answer
    
I didn't quite understand that last sentence. If you were requesting that I teach you how to run Apache as root for learning purposes, then I already have (replace www-data above). However if you were asking why it is a bad idea to do such a thing, I answer with the question 'why is it a bad idea to give someone root access to a shell'. As there may only be small step from Apache to a shell if you don't set things up properly. –  Huckle Mar 28 '12 at 2:27
    
Also please mark the question as answered (Up vote if you feel it was helpful :) –  Huckle Mar 28 '12 at 2:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.