Editing sudoers.d to allow www-data run a specific file

Question

I am running an Ubuntu server using Amazon AWS and I am trying to allow www-data to run a specific file that will push code to my git repository.

The file is under /var/ and I named it push.sh. I made a file under sudoers.d and added the following line using visudo:

www-data ALL=NOPASSWD: /var/push.sh

Whenever I run

sudo -u www-data sudo -l

I get the following response, "User www-data may run the following commands on (serverip): (root) NOPASSWD: /var/push.sh". However when I try to run this code

sudo -u www-data sudo sh /var/push.sh

I am being asked to enter a password for www-data.

Also when I make a php file to run the code using shell_exec

sh /var/push.sh

works fine, but

sudo sh /var/push.sh

does not. I would do it this way but the problem is I need to use sudo in order for the git to push properly.

I am probably missing something simple but I've been stuck on this for hours. Any help would be appreciated, thanks.

P.S. let me know if i need to give more information

Answer 1

The entry

www-data ALL=NOPASSWD: /var/push.sh

allows www-data to execute exactly the command /var/push.sh without a sudo password. It does not extend the ability to sudo sh /var/push.sh or even sh /var/push.sh

To work the way that you want, you must make /var/push.sh executable in its own right i.e.

• make sure it has the appropriate shebang at the top (presumable #!/bin/sh since you are trying to run it explicitly with sh)

• make it executable by at least www-data

Then invoke it directly as sudo -u www-data /var/push.sh