I've got following Problem: my Apache and PHP script are running as user www-data.
I want to call a script that can only be executed as root, so I added a new File to /etc/sudoers.d to allow this command for the www-data user:
echo390:/var/www/html# cat /etc/sudoers.d/iptables www-data ALL= NOPASSWD: /sbin/iptables
my PHP script looks as follows:
<?php $command = '"/usr/bin/sudo" "/sbin/iptables" -L -v -n | grep "126.96.36.199"'; echo 'Benutzer: '.exec('whoami').'<br/>'; echo 'Command: '.$command.'<br/>'; $result = array(); exec($command,$result); print_r($result); ?>
if I call the script from the command line via: sudo -u www-data /usr/bin/php test.php everything runs as expected, but when I call the script via Apache, I got the following error in apache2/error.log:
sudo: PERM_ROOT: setresuid(0, -1, -1): Operation not permitted
I've Upgraded Ubuntu from 12.02 to 14.04 The Same script had run in Ubuntu 12.02 without any problems. Can anybody help me? where is the error here?
groups for www-data:
echo390:~$ groups www-data
www-data : www-data
I use the Apache-mpm-itk module sothat every apache virtual host runs under a separate user id. So how do you allow a specific Apache user to execute a specific shell script with root privileges (in php etc)?
Thanks in advance and kind regards Ravermeister