0

I have a bash script in /var/www/html/exe. This folder is owned by www-data:www-data

PHP code calls this script, running as www-data. I test it using sudo -u www-data script.sh

sudo tee: I get permission denied trying to write a file from the script, e.g. as a test:

echo 10 | sudo tee tttt

It prompts for the www-data sudo password. This won't work.

Temp file: I also tried writing a temp file to the /home/ubuntu folder, also permission denied

Nopasswd: I could also apparently add www-data to require no password in the sudoers file. This is bad because it requires extra custom setup. Deployment is automated and this increases the complexity of the deployment code.

Shell: I tried various combinations of running in a different shell, e.g. $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE" These resulted in prompting for the www-data sudo password, can't work.

Sudo: I don't think I should have to (nor do I want to) run the shell as sudo. Besides, this is a service and would require a change to code I don't own.

Manual intervention: Many of the answers I found suggest things like "log in as root". There is no human around to do this: the code is automatically built and deployed into multiple environments.

Hacky workaround: Write a cpp exe which writes the file and calls it from the script. I can write files this way with no problem. But this feels awful and adds complexity to build/deploy.

After reading dozens of pages about how Linux handles permissions and shells, I am still not sure I completely understand how shells and subshells interact with permissions. I suspect there is a way to do this, but how?

Improve this question
3
  • Maybe it's just me confused, but anyway - where do you want to put your output from your script? What are permissions/ownership on that folder. What are traversal permissions, too - on directories above the one you try to write to. You're pretty much right about that you shouldn't need sudo etc. - unless really some special situation. Anyway - make sure your script invoked by web server really works as www-data:www-data, then make sure that user/group has proper access permissions to the directory you want to access. I know it may be confusing at the beginning, but it's not really that bad.
    – Jacek
    Aug 26, 2016 at 15:39
  • Anyway - basically methodically check all the path you have to traverse to reach the folder where you want to write to.
    – Jacek
    Aug 26, 2016 at 15:39
  • Also - one thing you may do to better see what happens - become www-data user (su - www-data -s /bin/bash) and try to enter that directory - and you may easier see where you're blocked.
    – Jacek
    Aug 26, 2016 at 15:40

1 Answer 1

Reset to default
1

If a script running as user www-data runs the command echo 10 | sudo tee tttt, then it's user www-data requesting root privileges through sudo, something it is probably not allowed to do.

Since the script itself is running as www-data and you want to write to a directory owned by that user, there is no need for sudo: the write operation (the command tee) will be run with the privileges of user www-data as well. So what you want is echo 10 | tee tttt, or just echo 10 > tttt.

As an aside, consider using printf instead of echo to print strings.

Improve this answer
1
  • Excellent, thank you. It turned out to closer to my original understanding before I became extra confused after trying the sudo.
    – James C
    Aug 26, 2016 at 21:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .