My situation is this: I'm trying to give the www-data user the ability to sudo-execute some shell scripts, so that I can have a page on my web server display system information (in PHP using shell_exec() ). To this end, I edited my sudoers file with the following line
www-data ALL=(ALL:ALL) NOPASSWD: /home/evermind/scripts/*
to give Apache the ability to run scripts in that directory without needing a password for suoo. Unfortunately, this doesn't work, nor does (as a sanity check) specifying a specific script within that directory. shell_exec fails to execute the command, and gives the following error:
sudo: no tty present and no askpass program specified
This is where things get...strange. If I replace the path specification with "ALL" then everything works perfectly. Why is this? Is there a reason I can't specify NOPASSWD for individual files or directories?
For security reasons, I am extremely hesitant to allow www-data free reign over everything, even though the web application is extremely secure and there isn't an obvious way anyone could execute arbitrary commands.
even though the web application is extremely secure and there isn't an obvious way anyone could execute arbitrary commands.
Famous last words :D