I've got following Problem: my Apache and PHP script are running as user www-data.
I want to call a script that can only be executed as root, so I added a new File to /etc/sudoers.d to allow this command for the www-data user:
echo390:/var/www/html# cat /etc/sudoers.d/iptables
www-data ALL= NOPASSWD: /sbin/iptables
my PHP script looks as follows:
<?php
$command = '"/usr/bin/sudo" "/sbin/iptables" -L -v -n | grep "220.177.198.43"';
echo 'Benutzer: '.exec('whoami').'<br/>';
echo 'Command: '.$command.'<br/>';
$result = array();
exec($command,$result);
print_r($result);
?>
if I call the script from the command line via: sudo -u www-data /usr/bin/php test.php everything runs as expected, but when I call the script via Apache, I got the following error in apache2/error.log:
sudo: PERM_ROOT: setresuid(0, -1, -1): Operation not permitted
I've Upgraded Ubuntu from 12.02 to 14.04 The Same script had run in Ubuntu 12.02 without any problems. Can anybody help me? where is the error here?
groups for www-data:
echo390:~$ groups www-data
shows
www-data : www-data
As info:
I use the Apache-mpm-itk module
sothat every apache virtual host runs under a separate user id.
So how do you allow a specific Apache user to execute a specific shell script with
root privileges (in php etc)?
Thanks in advance and kind regards Ravermeister
groups www-data
output?echo390:~$ groups www-data
shows:www-data : www-data
AssignUserID www-data www-data
for this virtual host, it is the default host anyway. and this was the first sudo directive I've added to the /etc/sudoers.d (The system users were all added to the group sudo viaadduser mySystemUser sudo
and there are running apache instances with users who do not have sudo rights