I've got following Problem: my Apache and PHP script are running as user www-data.

I want to call a script that can only be executed as root, so I added a new File to /etc/sudoers.d to allow this command for the www-data user:

echo390:/var/www/html# cat /etc/sudoers.d/iptables
www-data ALL= NOPASSWD: /sbin/iptables

my PHP script looks as follows:

<?php
$command = '"/usr/bin/sudo" "/sbin/iptables" -L  -v -n | grep "220.177.198.43"';
echo 'Benutzer: '.exec('whoami').'<br/>';
echo 'Command: '.$command.'<br/>';
$result = array();
exec($command,$result);
print_r($result);
?>

if I call the script from the command line via: sudo -u www-data /usr/bin/php test.php everything runs as expected, but when I call the script via Apache, I got the following error in apache2/error.log:

sudo: PERM_ROOT: setresuid(0, -1, -1): Operation not permitted

I've Upgraded Ubuntu from 12.02 to 14.04 The Same script had run in Ubuntu 12.02 without any problems. Can anybody help me? where is the error here?

groups for www-data:
echo390:~$ groups www-data
shows
www-data : www-data

As info:
I use the Apache-mpm-itk module sothat every apache virtual host runs under a separate user id. So how do you allow a specific Apache user to execute a specific shell script with root privileges (in php etc)?

Thanks in advance and kind regards Ravermeister

  • could you post groups www-data output? – Lety Jul 9 '14 at 22:48
  • Hi, output is: echo390:~$ groups www-data shows: www-data : www-data – Jonny Rimkus Jul 10 '14 at 8:30
  • Did you add sudoers directive for all user and groups defined in Apache-mpm-itk directive? It seems that sudo doesn't know user uid, are you using AssignUserID or AssignUserIDExpr? – Lety Jul 14 '14 at 21:35
  • Hi, I used AssignUserID www-data www-data for this virtual host, it is the default host anyway. and this was the first sudo directive I've added to the /etc/sudoers.d (The system users were all added to the group sudo via adduser mySystemUser sudo and there are running apache instances with users who do not have sudo rights – Jonny Rimkus Jul 15 '14 at 22:27
  • In Apache-mpm-itk documentation I found: Since mpm-itk has to be able to setuid(), it runs as root (although restricted with POSIX capabilities and seccomp v2 where possible) until the request is parsed and the vhost determined. Does apache daemon runs as root or runs as www-data and mpm-itk module grants root privilege? – Lety Jul 15 '14 at 23:00

Fix for apache2.4 and mpm-itk
Place this in /etc/apache2/conf-enabled/security.conf

<IfModule mpm_itk_module>
    LimitUIDRange 0 6000
    LimitGIDRange 0 6000
</IfModule>

and restart apache.

This is not needed on apache2.2 but once I upgraded to apache2.4 my PHP scripts that were using shell_exec and sudo stopped working.

I find it rather weird to suggest to disable the mpm-itk as there might be a reason why it is actually used.

We use mpm-itk (version 2.4.7-02) with apache 2.4 and it works perfectly. The only thing to consider here are the new configuration directives

LimitUIDRange

and

LimitGIDRange

These directives define, which UIDs and GIDs mpm-itk can use (via setuid/setguid). As you obviously want it to be able to become root, your lower range must be ID 0. The following configuration will work here:

<IfModule mpm_itk_module>
    LimitUIDRange 0 6000
    LimitGIDRange 0 6000
</IfModule>

Be aware, the the upper border should include all user UID/GID combinations that you want to use within your configuration via AssignUserID.

Note that you can configure this for each virtual host you have. Note too, that you need a Linux kernel 3.5.0 or higher for this.

  • Hit this feature, but LimitUIDRange is not helping. If I put it in a virtualhost, it says that it can't be put on a virtualhost, if I put outside I don't get any errors but it doesn't solve anything. Suggestions? (Ubuntu 14.04 with apache 2.4 with mpm-itk) – Giovanni Toraldo Jul 27 '15 at 15:29

Your sudoers configuration is right, in fact when you exec:

  sudo -u www-data /usr/bin/php test.php

it work as expected.

In normal operation, your apache runs as root and use mpm-itk module. Here is the problem.

According to mpm-itk documentation:

Since mpm-itk has to be able to setuid(), it runs as root (although restricted with POSIX capabilities and seccomp v2 where possible) until the request is parsed and the vhost determined.

and:

mpm-itk is based on the traditional prefork MPM, which means it's non-threaded; .... You will also take an additional performance hit over prefork, since there's an extra fork per request.

This means that mpm-itk fork apache process and use setuid() in order to assign desired user to each virtual host.

According to setuid manual:

The setuid() function checks the effective user ID of the caller and if it is the superuser, all process-related user ID's are set to uid. After this has occurred, it is impossible for the program to regain root privileges.

This could explain already, but not convinced, I downloaded the source of mpm-itk and I notice that it change capability permit and restrict the uid range from 1 to UINT_MAX.

If a thread drops a capability from its permitted set, it can never reacquire that capability

My conclusion is that by using mpm-itk your php scripts can't gain root permission.

If you have the chance, you can check if running apache as www-data and disabling mpm-itk module your test.php works.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.