My situation is this: I'm trying to give the www-data user the ability to sudo-execute some shell scripts, so that I can have a page on my web server display system information (in PHP using shell_exec() ). To this end, I edited my sudoers file with the following line
www-data ALL=(ALL:ALL) NOPASSWD: /home/evermind/scripts/*
to give Apache the ability to run scripts in that directory without needing a password for suoo. Unfortunately, this doesn't work, nor does (as a sanity check) specifying a specific script within that directory. shell_exec fails to execute the command, and gives the following error:
sudo: no tty present and no askpass program specified
This is where things get...strange. If I replace the path specification with "ALL" then everything works perfectly. Why is this? Is there a reason I can't specify NOPASSWD for individual files or directories?
For security reasons, I am extremely hesitant to allow www-data free reign over everything, even though the web application is extremely secure and there isn't an obvious way anyone could execute arbitrary commands.