I am running an Ubuntu server using Amazon AWS and I am trying to allow www-data to run a specific file that will push code to my git repository.

The file is under /var/ and I named it push.sh. I made a file under sudoers.d and added the following line using visudo:

www-data ALL=NOPASSWD: /var/push.sh

Whenever I run

sudo -u www-data sudo -l

I get the following response, "User www-data may run the following commands on (serverip): (root) NOPASSWD: /var/push.sh". However when I try to run this code

sudo -u www-data sudo sh /var/push.sh

I am being asked to enter a password for www-data.

Also when I make a php file to run the code using shell_exec

sh /var/push.sh

works fine, but

sudo sh /var/push.sh

does not. I would do it this way but the problem is I need to use sudo in order for the git to push properly.

I am probably missing something simple but I've been stuck on this for hours. Any help would be appreciated, thanks.

P.S. let me know if i need to give more information

  • What are the permissions of push.sh – Panther Jul 7 '18 at 13:14
  • It's set at octal mode 755 – CodingLogistics Jul 7 '18 at 13:34

The entry

www-data ALL=NOPASSWD: /var/push.sh

allows www-data to execute exactly the command /var/push.sh without a sudo password. It does not extend the ability to sudo sh /var/push.sh or even sh /var/push.sh

To work the way that you want, you must make /var/push.sh executable in its own right i.e.

  • make sure it has the appropriate shebang at the top (presumable #!/bin/sh since you are trying to run it explicitly with sh)

  • make it executable by at least www-data

Then invoke it directly as sudo -u www-data /var/push.sh

| improve this answer | |
  • Perfect, thanks. Got it to execute the file, just need to figure out why my git commits but won't push, but that's a whole different issue. – CodingLogistics Jul 7 '18 at 13:51
  • Also whenever I add that sheband to the top I get this error. "-bash: /var/push.sh: /bin/sh^M: bad interpreter: No such file or directory" – CodingLogistics Jul 7 '18 at 15:01
  • @MarkJohnson that's a classic symptom of having edited the file in a Windows (or possibly Mac) text editor - the ^M is a representation of the carriage return line-ending – steeldriver Jul 7 '18 at 15:20
  • Thanks for the help, I used dos2unix to fix it and code runs fine. I was using Atom to edit the .sh file. I also now realize that this is what caused me hours of frustations ._. – CodingLogistics Jul 7 '18 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.